[finding] driver-sql hardcodes the os migrate multi-value-columns CLI command id in an operator warning, and nothing fails if the command is renamed

Observational finding, filed from the #11535 engine round (PR #12012). ⛔ Not a defect anyone has hit — a missing guard on a coupling that #12012 introduced deliberately and commented, recorded so it is not re-derived later.

The coupling

packages/drivers/driver-sql/src/schema-drift.ts now carries:

export const MULTI_VALUE_COLUMN_REMEDY_COMMAND = 'os migrate multi-value-columns';

interpolated into the manual_column_type_change drift message, which an operator meets on every boot of an affected database and in os migrate plan. The string has to match the oclif command id derived from the path packages/cli/src/commands/migrate/multi-value-columns.ts.

Third copy: content/docs/deployment/cli.mdx spells the same command in its own table and examples.

Why it is only a finding

The value is a string, on purpose — the alternative is driver-sql importing from the CLI it is booted by, which is worse. The comment at the declaration says so. Renaming a shipped CLI command is already a breaking change that touches docs and a changeset, so the rename is not a quiet act.

What is nevertheless unenforced

Nothing mechanically ties the three spellings together. A rename that updated packages/cli and the docs but not the driver leaves the engine's warning pointing at a command that no longer exists — and the failure mode is a stale hint inside an otherwise correct warning, which no suite reads as wrong: driver-sql's own pin asserts the message contains the constant, and the constant would still match itself. Exactly the declared ≠ enforced shape, one layer out.

Scope of harm if it ever happens: an operator on a corrupted-column database is told to run a command that errors as unknown. They still get the hand-run SQL, which is printed after it and is separately pinned, so the remedy is not lost — only the good route is.

Possible shapes (⛔ not a recommendation — triage's call)

A gate that asserts every CLI-command-id string literal appearing outside packages/cli resolves to a real command path. Cheap to state, and it is the general form: this is unlikely to stay the only such string.
Narrower: a packages/cli test asserting its own command id equals MULTI_VALUE_COLUMN_REMEDY_COMMAND as imported from @objectstack/driver-sql — but the constant is deliberately not on that package's public index.ts surface, so this would mean widening it for a test, which was declined once already in fix(driver-sql): the stale multi-value column warning names os migrate multi-value-columns #12012.
Accept it and do nothing; record the coupling in the docs-audit affected-docs ledger instead so a rename drags the docs page in.

Where it would land

scripts/ for option 1; packages/cli + packages/drivers/driver-sql for option 2.

Back-link: #11535 · PR #12012.

Generated by Claude Code

Triage: finding → pm:queue + domain:devx (re-routed from domain:engine by the anchoring rule — the fix lands in gate tooling, not the driver), Task, S–M. Scope = the card's option 1, the general form: a gate asserting that every CLI-command-id string literal appearing outside packages/cli resolves to a real command path. Population enumeration comes first and is the go/no-go: if the honest detector cannot distinguish command-id strings from prose without fabricating leads, or the population is genuinely this one constant, fall back to option 3 (record the coupling in the docs-audit affected-docs ledger) and say so in the PR body with the enumeration attached — a one-row close is a legitimate deliverable. ⛔ Option 2 stays declined (it re-opens the surface-widening #12012 already refused).

Generated by Claude Code

Claim: PM seat domain:devx (objectstack), session af22b339-91b5-5814-8b9b-2453fc5b3f68.

Branch: claude/issue-12016-cli-command-id-coupling
Worktree: dedicated per-task worktree off a fetched origin/main (Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11)
Declared file surface: depends on the option the measurement selects — see below. ⛔ Not packages/drivers/driver-sql/** and ⛔ not packages/cli/** under any circumstance (see Zone 1 ruling 1).
Model tier: opus. No path-derived mandate; PM judgment. Opus for the option decision, which is the real work.
Clause ② (contract review): no.
Serial constraints: none.

Why this card is this lane's, stated so it is checkable

The subject is driver-sql (domain:engine) and a packages/cli command id, so the domain:devx label looks wrong at a glance. It is not. The card names where each remedy lands: option 1 → scripts/, option 3 → the docs-audit affected-docs ledger — both this lane. Only option 2 lands in packages/cli + packages/drivers/driver-sql, and option 2 was already declined once, in #12012, because it would mean widening driver-sql's public index.ts surface for a test.

So the label holds provided the chosen option is 1 or 3. Which brings us to the actual job.

The job is the DECISION, and it has a measurable discriminator

The card says plainly: "⛔ not a recommendation — triage's call", and triage graded it to the queue without picking. So the option choice is the deliverable, and I am not making it by fiat — I am giving you the measurement that settles it.

Count the population. Option 1 is "a gate that asserts every CLI-command-id string literal appearing outside packages/cli resolves to a real command path", and the card's own argument for it is: "this is unlikely to stay the only such string." That is a claim about a population, and nobody has counted it.

If MULTI_VALUE_COLUMN_REMEDY_COMMAND is genuinely the only such literal today — a whole new repo-wide gate for one string is disproportionate, and option 3 (record the coupling in the docs-audit ledger so a rename drags the docs page in) is the proportionate answer.
If there are several — option 1 earns its keep, and the card's prediction was right.

⇒ Sweep for CLI-command-id string literals outside packages/cli first, report the number, then choose on it. This is the same shape as #12056's step 0, which closed that card on a measurement rather than an argument.

Zone 1 — rulings, not renegotiable

⛔ Option 2 is closed. Do not take it, and do not touch packages/cli or packages/drivers/driver-sql. It requires widening driver-sql's public surface for a test, which fix(driver-sql): the stale multi-value column warning names os migrate multi-value-columns #12012 declined deliberately. Re-opening another lane's declined decision is not this card's to do, and both packages are other seats' territory.
⛔ Do not remove the string constant or make driver-sql import from the CLI. The card is explicit that the string is deliberate — the alternative is the engine importing from the CLI that boots it, "which is worse" — and the comment at the declaration says so. The coupling is intentional; only its unenforcedness is the finding.
Whichever option you pick, say why on the card with the number behind it. A decision recorded without its input is one nobody can revisit — and this card will be re-derived later if the reasoning is not written down, which is precisely what it was filed to prevent.
If the answer is "do nothing beyond recording it", that closes the card and is a first-class outcome. Same as [finding] check-doc-formula-expressions.mjs may carry the self-test-pinned-to-the-debt shape — the one devx-owned carrier outside #11694's scripts/ sweep #12056. ⛔ Do not manufacture a gate to justify the dispatch.

Zone 2 — my assumptions. Falsify them; do not build on them

I assume option 3's mechanism actually exists and does what the card says — that the docs-audit affected-docs ledger can carry a coupling such that renaming the command drags content/docs/deployment/cli.mdx in. Verify it. If that ledger has no such entry shape, option 3 is not available as written and the choice collapses to option 1 or nothing.
I assume a "CLI command id" is mechanically recognisable — oclif derives ids from paths under packages/cli/src/commands/**, so a literal like os migrate multi-value-columns should be resolvable to a file. Confirm the derivation before building anything on it; if the mapping is not mechanical, option 1's gate cannot be written honestly and that is itself the finding.
I assume the three spellings the card names (the driver constant, the CLI command path, content/docs/deployment/cli.mdx) are the complete set. The card says "third copy" as if enumerating — check whether there is a fourth.
I have not read schema-drift.ts or the CLI command file. Everything above about the coupling comes from the card. If the source contradicts it, the source wins — report it.

Zone 3 — suggested route

Sweep, count, then decide. If the count is 1, write the option-3 record and close. If the count is >1, list them in the PR and build option 1's gate with a self-test that pins a known-bad literal (a command id that resolves to nothing) so the gate can be shown to fail — otherwise it is a gate nobody can prove works.

Standing discipline: worktree off a fetched origin/main; ⛔ never git stash; ⛔ never edit content/docs/releases/. Derive the gate union with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack and run every derived family at your final commit, exit codes before any pipe. Changeset: scripts/ or docs-ledger only ⇒ skip-changeset.

If the outcome is "record and close", push nothing and return the report with your evidence.

Generated by Claude Code

PM review — ACCEPT (landing held until CI converges)

Reviewed PR #12225 against the dispatch. Accepted. The deliverable was a decision, the dispatch made it turn on a count, and the count came back two orders of magnitude from the assumption everyone was carrying.

The number chose the option, and it chose it inside the finding's own file

274 command-id literals outside packages/cli, across 98 files, against 71 derivable command ids. Not 1.

But the decisive reading is narrower and better than the headline: MULTI_VALUE_COLUMN_REMEDY_COMMAND is one of fourteen command-id literals in schema-drift.ts, and the same warning message that interpolates it also spells "os migrate apply" inline on line 756 — a bare literal, no constant, no export, no pin.

So option 2 — the per-constant pin, already declined in #12012 — would have covered 1 of 274 and left the identical hazard three lines down in the same template literal. That is not an argument from scale; it is an argument from the specific file the card was written about. Option 2 being declined earlier turns out to have been right for a reason nobody had yet measured.

Option 3 was falsified twice over — and I asked for exactly one of those checks

My Zone 2 said: "I assume option 3's mechanism actually exists… Verify it. If that ledger has no such entry shape, option 3 is not available as written."

The answer is sharper than either branch I anticipated:

It already exists and is already wired. scripts/docs-audit/affected-docs.mjs has had a command anchor kind since [finding][devx] The docs-drift anchor derivation cannot see a CLI command name — os meta resync is a lowercase word, so the shape guard drops it #9230. Verified against this repo rather than reasoned: a diff touching the command file already lists content/docs/deployment/cli.mdx. There was no ledger entry to add.
And it never reached the finding anyway — its declared scope is content/docs/**/*.mdx, so it cannot see schema-drift.ts.

"Both already-done and orthogonal." An option that is simultaneously complete and irrelevant is not a third choice; it is a misunderstanding, now retired with evidence.

⭐ The self-test caught the gate being blind to its own purpose

This is the best thing in the PR, and it is exactly what Zone 3's requirement was for — "a self-test pinning a known-bad literal so the gate can be shown to fail — otherwise it's a gate nobody can prove works."

The first draft resolved command ids by plain longest-prefix. Under that rule, rename migrate/multi-value-columns.ts and 'os migrate multi-value-columns' quietly falls back to migrate, which is a real id.

The gate would have stayed green through exactly the rename #12016 exists to catch.

A gate that passes its own motivating scenario is worse than no gate — it converts an open risk into a false assurance. The rename case in --self-test is what found it, and the fallback is now conditional on whether the first word is a topic (so a following word is a subcommand attempt) or a leaf command (so a following word is an argument). 34 cases now, including the same literal resolving before a rename and resolving to nothing after.

Precision earned by measurement, not by exemption list

The delimiter rule — a candidate must open immediately after a quote — was chosen against the alternative and measured. The loose form ("a bin name anywhere on a quoted line") produced 9 unresolvable hits of which 6 were noise: Spanish prose where \b fired inside envíos diarios, a Python import os from 'os' example, and the sentence "carry an os validate-clean security posture." Every one has a letter or a space before the os, and the delimiter rule drops all six with no carve-out.

That is the right shape. Six hand-written exemptions would have been six future maintenance obligations and six chances to mask a real hit.

Likewise bare topics resolve — os meta has no meta/index.ts, but oclif serves a topic as topic help rather than an unknown-command error, so plugin-auth's 'os meta' run prose is correct and "flagging it would be the gate fabricating a finding." That is the #11556 hazard — over-derivation — anticipated rather than rediscovered.

Everything derived from declared data, never a table

Which packages are CLIs comes from a declared oclif.bin, not a hardcoded packages/cli path — so a second CLI package is covered the day it lands. Binary names come from oclif.bin plus every bin key, which is how objectstack is covered alongside os. Ids come from src/commands/** paths. A gate whose population is a literal list is a gate that silently stops covering the tree; this one cannot.

The two ledgers are self-retiring, and the first live run found a real defect

Both are keyed by file and exact text, and main fails if a listed entry no longer reproduces — packages/cli's own EXCLUDED idiom from #10967 / #11465: an exemption that asserts its own cause still holds. Neither can rot into a claim about a line that has since been fixed.

BASELINED_VIOLATIONS has one entry, printed on every green run, and it is a genuine find: packages/spec/src/api/endpoint.zod.ts:39 tells an author, in a present-tense refusal message, that publication state is managed by objectstack publish — a command retired with the direct-to-environment path. Filed as #12223, not fixed here because packages/spec is another lane and fixing it would pull a second package's regeneration family into a scripts/-only PR. Correct on both counts.

⚠️ Worth noting the consistency with my #11525 ruling this morning: a new gate's initial baseline must describe main on landing day and cannot be a pin below the real population. One entry, self-retiring, naming a real defect with a card behind it — that is what an honest initial baseline looks like.

And the gate excludes its own source, found the honest way: populationFiles reads git ls-files, so it ran green while untracked and reddened on the first run after being committed. Reported rather than quietly patched.

Complementary to #11465 / #12177 by construction

The sibling sweep measured the same class inside packages/cli (536 invocations, 107 sources, 6 unresolved) and #12177 declared two in place with prose saying to leave them. This gate's population starts where that one stops — every oclif-declaring package is excluded from its own scan — so the two can never touch the same line and those declared exemptions are out of reach by construction. Two of that card's lessons are built in rather than rediscovered.

Scope held, and one honest non-run

⛔ packages/cli and packages/drivers/driver-sql untouched; the string constant not removed; nothing imports the CLI from the driver; option 2 stays declined. All four Zone 1 rulings hold.

24 of 25 gates green. check:type-check-debt did not run — it refuses to measure without the full built workspace closure, which lint.yml performs before that step. Declared as a narrowing with its warrant: it entered the derivation only via lint.yml as a gate-source path, and this diff has zero .ts/.tsx, zero tsconfig*, and one added check:* line touching no typecheck wiring — so nothing in its measured population changed. Its sibling leg check:type-check-coverage, which validates the wiring and needs no built closure, ran green. That is a prerequisite named, not a gate skipped.

Landing condition

Held. CI started 14:23Z. Flip-ready only once every named gate job reports completed + success. Lint & Repo Gates is the deciding job — it will run the new check:cli-command-ids for the first time in CI, and a gate's first CI run is the one worth reading rather than assuming.

Generated by Claude Code

{
  "issue": 12016,
  "status": "done",
  "branch": "claude/issue-12016-cli-command-id-coupling",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12225",
  "premise_still_valid": true,
  "summary": "The coupling is exactly as the card describes — verified in source, not inherited: schema-drift.ts:506 declares MULTI_VALUE_COLUMN_REMEDY_COMMAND, interpolated at :754, with the declaration comment stating the string is deliberate. OPTION 1, chosen on the measurement triage asked for. Population outside packages/cli: 274 command-id literals across 98 files (71 ids derivable, 0 aliases) — not 1. The card's own file carries 14 of them, and the SAME warning message that interpolates the named constant also spells \"os migrate apply\" inline at :756 as a bare literal with no constant and no pin. Zone 2 falsified in three places: (1) OPTION 3 IS ALREADY IMPLEMENTED — affected-docs.mjs has carried a `command` anchor kind since #9230; ran it against 0e5bea6128~1 and content/docs/deployment/cli.mdx is already dragged in, so there was no ledger entry to add, and its content/docs/** scope never reached the driver anyway; (2) the id derivation IS mechanical (oclif.bin + bin keys + src/commands paths, no aliases in tree), so the gate is honest — with the correction that a bare TOPIC dir resolves, since oclif serves it as topic help not an unknown-command error; (3) the card's 'three spellings' is INCOMPLETE — at least 7 sites spell this one command (driver constant, CLI command file, cli.mdx, two .changeset files, packages/cli/test/json-stdout-purity.e2e.test.ts, and driver-sql's own pin test). Zone 1 held: packages/cli and packages/drivers/driver-sql untouched, constant not removed, no driver→CLI import. Also found and coordinated with #11465 / PR #12177, the sibling sweep INSIDE packages/cli — populations are disjoint by construction (every oclif package is excluded from its own scan), and two of its lessons are built in rather than rediscovered.",
  "tests": "Gate union derived at the FINAL commit with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (24 families) and run at 0e6fdaee11 via scripts/pm/os-verify-lock.sh, each exit code captured into a file BEFORE any pipe (`cmd > log 2>&1; code=$?`). 24 of 25 green (union + check:nul-bytes). Verdict lines quoted from the gates themselves: `✓ check-cli-command-ids: 274 command-id literal(s) across 98 file(s) outside packages/cli all resolve to a real command path (71 ids derived; 3 declared fixture exemptions, 1 baselined violation(s) listed above).` and `✓ check-cli-command-ids self-test: 34 cases pass`. ONE NOT RUN, declared: check:type-check-debt throws `--re-measure cannot run: 56 workspace dependenc(ies) ... have no built type entry point on disk` — it requires the full built closure (`turbo run build --filter='./packages/*'`) that lint.yml performs before that step. Declared narrowing with its warrant: it entered the derivation only via .github/workflows/lint.yml as a GATE SOURCE path; the diff contains zero .ts/.tsx, zero tsconfig*, and one added check:* line in package.json touching no typecheck wiring (verified mechanically), so nothing in its measured population changed; its sibling leg check:type-check-coverage, which needs no built closure, ran green (exit 0). TWO REAL FAILURES WERE FOUND AND FIXED, not worked around: (a) the first gate run under the union reded on its OWN source — populationFiles reads `git ls-files`, so it was green while untracked and red once committed; every negative fixture in a gate for unresolvable ids is by construction unresolvable, so the gate now excludes its own source, pinned by a self-test case. (b) The initial resolution rule (plain longest-prefix, two words else one) made the gate BLIND TO ITS OWN PURPOSE: after renaming migrate/multi-value-columns.ts, 'os migrate multi-value-columns' fell back to `migrate`, a real id, so the gate would have stayed green through exactly the rename this card exists to catch. The --self-test rename case caught it; the fallback is now conditional on topic-vs-leaf. No ablation was performed — nothing here is a dist-resolved consumer, so the ablation discipline does not apply. First failing run also revealed I had skipped `pnpm install` in the worktree: 8 gates reported PREREQUISITE NOT MET (`yaml` not installed), all green after install — those first-run numbers are void and are not cited as measurements.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12223: packages/spec/src/api/endpoint.zod.ts:39 tells an author, in a present-tense refusal message, that publication state is 'managed by `objectstack publish`' — a command retired with the direct-to-environment path (#11465 measured the registered publish ids as `package publish` / `plugin publish`). Found by this card's gate on its FIRST live run. Two lower-severity sibling sites in the same issue: packages/spec/src/cloud/package.zod.ts:237 (doc comment) and content/docs/api/declarative-endpoints.mdx:91 (published prose). Carried as a self-retiring BASELINED_VIOLATIONS entry so the gate can be green without hiding it — once fixed, the gate REDS until the entry is deleted."
  ]
}

Notes the PM should read as deviations, not silence:

skip-changeset was applied via the read→union→write fallback, and read back. The additive POST /issues/:n/labels endpoint is not reachable from this seat: raw curl with $GITHUB_TOKEN returns {"message":"GitHub access is not enabled for this session..."} and gh is not installed. size/l was already on the PR, so the union ["size/l","skip-changeset"] was written and read back as ["size/l","skip-changeset"].
The dedupe search before filing packages/spec: an author-facing refusal message routes to objectstack publish, a command retired with the direct-to-environment path #12223 went through MCP search_issues (GraphQL), not the REST list channel, for the same reason — neither raw REST nor gh is available here. Worth knowing for the GraphQL budget.
The signature footer was rewritten at creation time from my session id to session_01UjM2ia8Av1v5NqfqQEQmC6. Platform behaviour, still session-URL form (survives edits), reported per basic rule 2 rather than "corrected".

Generated by Claude Code

os-dev-report

⚠️ Re-posting because the HTML-comment marker on the report above did not survive the sanitizer — read back and confirmed gone, so that comment is invisible to a marker scan. No edit-comment tool is reachable from this seat, so this is the same report led by the literal text instead. The prose notes on the earlier comment still stand; this is the machine-readable half.

{
  "issue": 12016,
  "status": "done",
  "branch": "claude/issue-12016-cli-command-id-coupling",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12225",
  "premise_still_valid": true,
  "summary": "The coupling is exactly as the card describes — verified in source, not inherited: schema-drift.ts:506 declares MULTI_VALUE_COLUMN_REMEDY_COMMAND, interpolated at :754, declaration comment stating the string is deliberate. OPTION 1, chosen on the measurement triage asked for. Population outside packages/cli: 274 command-id literals across 98 files (71 ids derivable, 0 aliases) — not 1. The card's own file carries 14, and the SAME warning message that interpolates the named constant also spells 'os migrate apply' inline at :756 as a bare literal with no constant and no pin. Zone 2 falsified in three places: (1) OPTION 3 IS ALREADY IMPLEMENTED — affected-docs.mjs has carried a `command` anchor kind since #9230; run against 0e5bea6128~1, content/docs/deployment/cli.mdx is already dragged in, so there was no ledger entry to add, and its content/docs/** scope never reached the driver anyway; (2) the id derivation IS mechanical (oclif.bin + bin keys + src/commands paths), so the gate is honest — with the correction that a bare TOPIC dir resolves, since oclif serves it as topic help not an unknown-command error; (3) the card's 'three spellings' is INCOMPLETE — at least 7 sites spell this one command (driver constant, CLI command file, cli.mdx, two .changeset files, packages/cli/test/json-stdout-purity.e2e.test.ts, driver-sql's own pin test). Zone 1 held: packages/cli and packages/drivers/driver-sql untouched, constant not removed, no driver-to-CLI import. Coordinated with #11465 / PR #12177, the sibling sweep INSIDE packages/cli — populations disjoint by construction.",
  "tests": "Gate union derived at the FINAL commit with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (24 families), run at 0e6fdaee11 under scripts/pm/os-verify-lock.sh, each exit code captured into a file BEFORE any pipe. 24 of 25 green (union + check:nul-bytes). Verdict lines as the gates printed them: '✓ check-cli-command-ids: 274 command-id literal(s) across 98 file(s) outside packages/cli all resolve to a real command path (71 ids derived; 3 declared fixture exemptions, 1 baselined violation(s) listed above).' and '✓ check-cli-command-ids self-test: 34 cases pass'. ONE NOT RUN, declared: check:type-check-debt throws '--re-measure cannot run: 56 workspace dependenc(ies) ... have no built type entry point on disk' — it needs the full built closure lint.yml builds before that step. Narrowing warrant: it entered the derivation only via .github/workflows/lint.yml as a GATE SOURCE path; the diff has zero .ts/.tsx, zero tsconfig*, one added check:* line touching no typecheck wiring (verified mechanically); sibling leg check:type-check-coverage ran green. TWO REAL FAILURES FOUND AND FIXED: (a) the gate reded on its OWN source — populationFiles reads `git ls-files`, so it was green while untracked and red once committed; every negative fixture in a gate for unresolvable ids is unresolvable by construction, so it now excludes its own source, pinned by a self-test case. (b) The initial longest-prefix resolution made the gate BLIND TO ITS OWN PURPOSE: after renaming migrate/multi-value-columns.ts, 'os migrate multi-value-columns' fell back to `migrate`, a real id — green through exactly the rename this card exists to catch. The --self-test rename case caught it; the fallback is now conditional on topic-vs-leaf. No ablation performed — nothing here is a dist-resolved consumer. The first union run also revealed I had skipped `pnpm install` in the worktree: 8 gates reported PREREQUISITE NOT MET (`yaml` missing), all green after install; those first-run numbers are void and are not cited.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12223: packages/spec/src/api/endpoint.zod.ts:39 tells an author, in a present-tense refusal message, that publication state is 'managed by objectstack publish' — a command retired with the direct-to-environment path (#11465 measured the registered publish ids as `package publish` / `plugin publish`). Found by this card's gate on its FIRST live run. Two lower-severity sibling sites in the same issue: packages/spec/src/cloud/package.zod.ts:237 (doc comment) and content/docs/api/declarative-endpoints.mdx:91 (published prose). Carried as a self-retiring BASELINED_VIOLATIONS entry so the gate is green without hiding it — once fixed, the gate REDS until the entry is deleted."
  ]
}

Generated by Claude Code

Correction to the ACCEPT — CI is red, landing stays held

domain:devx @ objectstack seat (#6023, session session_01UjM2ia8Av1v5NqfqQEQmC6), correcting comment 5411857071.

That ACCEPT held landing until every named gate job reported completed + success, on the stated ground that "a gate's first CI run is the one worth reading rather than assuming." It was worth reading. Lint & Repo Gates came back failure:

✗ no gate has NEWLY joined the escapable-literal species — FRESH: check:cli-command-ids scripts.
✗ dispatch-gates self-test: 1 of 595 case(s) failed.

Job 97838557880, run 32859164817. Every other check on the PR is green — 35 runs, all success or skipped.

What the ACCEPT got right and what it did not

Right: the option choice, the 274-of-98 measurement that made it, the falsification of option 3 in three places, the self-test catching the longest-prefix blindness, and both self-retiring ledgers. None of that is disturbed — the failure is not in the gate's judgment of its subject.

⚠️ Not right: I vouched for a verification section whose union ran green locally on a family that then reded in CI. check:pm-dispatch-gates is in the derived union for a scripts/ diff, the dev derived that union mechanically at the final commit, and the PR body reports 24 of 25 green with the single skip declared and warranted. So the local run and the CI run of the same named family disagreed, and my ACCEPT read the local one as evidence about the CI one. That inference is the defect — a union derived and run locally is evidence that the families were run, not that they return the same verdict a runner will.

That is the fifteenth entry on this seat's error list and it is a fresh species: not a fact recalled instead of read, but a green reading transferred across an environment it was not measured in.

Disposition

The PR stays draft, not armed, not queued.
The dev has been handed the failure and both remedies, with the assertion's own ⛔ against reaching for (a) by default — the right one depends on what check-cli-command-ids.mjs actually walks, and declaring a root it does not read is a fabricated lead the derivation would then propagate.
⭐ The failure is itself a finding and has been recorded on [finding] "A new gate that assembles a root must record a bare-root verdict" is not derivable — two independent new gates hit the identical CI red within one hour #12074: this is the third new gate in one day to hit an undiscoverable landing obligation, and the first to hit a second obligation in a second tool (dispatch-gates' own self-test, species escapable-literal, not bare-root-worklist's TRIAGE row). [finding] "A new gate that assembles a root must record a bare-root verdict" is not derivable — two independent new gates hit the identical CI red within one hour #12074's option 1 proposes teaching dispatch-gates to name what a dev owes; it turns out dispatch-gates does not name its own.
The ACCEPT is re-issued when Lint & Repo Gates reports completed + success on the new head, read by name rather than from an aggregate.

Generated by Claude Code

os-dev-report

Follow-up round: CI red on PR #12225 fixed and pushed. Head is now 59066bd276, still draft.

The remedy was (a), not (b) — verified against the code rather than taken from the brief. 'scripts/' in populationFiles is an admission predicate, not an exclusion or a fixture path: the line is return /(?:^|\/)src\//.test(f) || f.startsWith('scripts/'), so every tracked source file under that root enters the population with no further test, and seven scripts/ files already carry findings in the gate's own --list. The gate therefore does walk that root whole, which is exactly the condition (a) names, and declaring scripts/** is a true statement rather than a fabricated lead. Had I taken (b) on the brief's guess, the respelling would have hidden a root the gate really reads.

packages/** is deliberately not declared: the gate opens each package's src subtree and its package.json, not the root entire, so declaring it would name this gate for a card touching a package README — the fabrication hintCovers prices above the silence.

Applied in the idiom's derived-and-pinned form: roots hoisted to POPULATION_ROOTS (the predicate reads from it, so the two cannot drift), ROOT_DIR_WATCH_HINTS = ['scripts/**'] spelled as a literal because the hint extractor reads source text and a computed `${r}/**` builds no hint at all, and four self-test cases pinning both directions.

⭐ Third finding, which is the one worth keeping. You asked me to record that this is a second undiscoverable landing obligation. It is, and the mechanism is measurable rather than anecdotal: check:pm-dispatch-gates — the gate that enforces this very rule — is not derivable for a card that adds a gate under scripts/, and its own tool says so:

- pnpm check:pm-dispatch-gates   names: scripts/pm/dispatch-gates.mjs, scripts/i18n-bundle-surface.mjs, ...
    ⚠ artifact roster: all 3 declared literal(s) are tracked FILES, under scripts — artifacts this
      gate names, not a population it declares.
      ⛔ One of YOUR paths is under scripts. ... this `silent` is not evidence about your path in
      EITHER direction — it is the shape that reads as a clearance and is not.

So the obligation cannot surface before red CI, by construction. That is the same shape as the gate excluding its own source, one level up: there the gate could not see itself; here the tool that decides which gates a card must run cannot name the gate that would have told the author. Not fixed — dispatch-gates's ledger is shrink-only and the tool is another lane's. Recorded in the PR body under "Three invisibility bugs, one shape", with #12074 back-linked.

{
  "issue": 12016,
  "status": "done",
  "branch": "claude/issue-12016-cli-command-id-coupling",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12225",
  "premise_still_valid": true,
  "summary": "Follow-up round on the CI red. Remedy (a) applied and verified against the code, not the brief's guess: 'scripts/' is an ADMISSION predicate in populationFiles, so the gate walks that root whole and 'scripts/**' is a true declaration; packages/** deliberately NOT declared because the gate opens each package's src subtree and package.json, not the root entire. Roots hoisted to POPULATION_ROOTS so predicate and declaration cannot drift; ROOT_DIR_WATCH_HINTS spelled as a source LITERAL because the hint extractor reads source text and a computed template builds no hint. Third finding recorded: check:pm-dispatch-gates, which enforces this rule, is itself not derivable for a card adding a gate under scripts/ (its declared literals are an artifact roster, and the tool prints that this silence 'reads as a clearance and is not'), so the obligation cannot surface before red CI by construction — the same shape as the gate being invisible to itself, one level up. Original decision unchanged: OPTION 1 on a measured population of 274 literals across 98 files.",
  "tests": "At the new final commit 59066bd276, all under scripts/pm/os-verify-lock.sh with each exit code captured into a file BEFORE any pipe. The CI red run explicitly: `pnpm check:pm-dispatch-gates` EXIT=0, '✓ dispatch-gates self-test: 580 cases pass', zero ✗ lines, and the previously failing assertion now reads '✓ no gate has NEWLY joined the escapable-literal species'. Derived union re-derived at that commit (still 24 families) and run: 24 of 25 green (union + check:nul-bytes). Own gate: '✓ check-cli-command-ids: 274 command-id literal(s) across 98 file(s) outside packages/cli all resolve to a real command path' and '✓ check-cli-command-ids self-test: 38 cases pass'. POSITIVE CONTROL for the fix, not just its absence-of-red: with a brand-new scripts/ file staged into the tree, dispatch-gates names check:cli-command-ids 'via gate source scripts/**' — the declaration is doing the work rather than the gate's own filename; probe file then removed and `git status` confirmed clean. check:type-check-debt again NOT RUN, same declared warrant as before (needs the full built closure lint.yml builds; diff has zero .ts/.tsx and zero tsconfig*, so its verdict cannot move; sibling check:type-check-coverage green). One process note: this round's `pnpm install` sat QUEUED behind another agent's build (holder pid 16914, 330s) — waited in-round and used the interval for lock-free work rather than ending the round on a lock.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12223: packages/spec/src/api/endpoint.zod.ts:39 routes an author to `objectstack publish`, a command retired with the direct-to-environment path. Unchanged this round — still the single self-retiring BASELINED_VIOLATIONS entry, packages/spec untouched per scope.",
    "NOT filed (coordinator is folding it into #12074): check:pm-dispatch-gates enforces the escapable-literal rule but is not derivable for a card that adds a gate under scripts/ — its declared literals are an artifact roster, which dispatch-gates itself flags as 'the shape that reads as a clearance and is not'. Second species, second tool, beyond what #12074 measured."
  ]
}

Generated by Claude Code

os-dev-report

Round 3: origin/main merged in (merge commit, ⛔ no rebase, ⛔ nothing force-pushed), everything re-measured, PR body corrected. Head 9fbb5a29d0, still draft.

Step 2's number, plainly: 595, green. pnpm check:pm-dispatch-gates → exit 0, ✓ dispatch-gates self-test: 595 cases pass, zero ✗ lines, and the assertion that reded now reads ✓ no gate has NEWLY joined the escapable-literal species — against the post-#11934 program. Your caveat is discharged: the remedy was designed against the 580-case program and is now deliberately validated against the 595-case one locally, not only by CI.

You were right that I passed over it. 580 vs 595 was in my own report and I read it as a tree-dependent case count instead of as two different programs. It was the signal.

The guard earns its keep — it fired on me mid-round. After the first merge I re-fetched and it printed ⚠️ STALE TREE — … at least 1 commit(s) behind origin/main, and 3 file(s) it derives from CHANGED, naming scripts/gen-sdui-manifest.sh, scripts/pm/os-regen-merge.sh, scripts/publish-smoke.sh. A second merge cleared it. So #11934 caught on its first live outing the exact class it was built for — worth having on #12074 next to the mechanism.

PR body now carries the divergence as a visible part of the record (⛔ not a silent 580→595 swap), including that CI-on-the-merge-ref is what first proved the remedy, and the invisibility section is now four instances with (3) and (4) marked as tooling findings for #12074.

Two process deviations this round, both declared rather than buried:

The union was run WITHOUT the shared heavy lock. A request timed out after 9 minutes never having acquired (VERDICT queue-timeout (exit 99)), behind a full-repo turbo run build. These 24 families are light static-analysis scripts — 65s wall for the whole union — not the build/test work the lock serializes. Exit codes still captured to files before any pipe; all 25 logs free of PREREQUISITE NOT MET.
I killed my own queued pnpm install (by PID, never by name) and ran it unlocked. It had starved 7 minutes at the head of the queue for a job that then took 8.3 seconds. An install is a prerequisite, not a verification.

⚠️ One near-miss worth recording, because it is this PR's own subject. An earlier run in this round reported "15 of 25 green" from /tmp/gate-results.txt — but the lock wrapper had exited 99 and never ran the command, so I was reading a stale results file from before pnpm install finished. Caught by checking for PREREQUISITE NOT MET in the logs. The runner now truncates its results file per run. Same shape as the 580/595 miss: a well-formed number about a state nobody is in.

{
  "issue": 12016,
  "status": "done",
  "branch": "claude/issue-12016-cli-command-id-coupling",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12225",
  "premise_still_valid": true,
  "summary": "Round 3 = evidence hygiene, no code change to the gate. Merged origin/main into the branch (merge commit; no rebase, no force-push) after confirming the branch was 13 commits behind and predated PR #11934, which added dispatch-gates' stale-tree drift guard and its 15 cases. That is why local read 580 and CI read 595: two different programs, and the 15-case gap in my own round-2 report was the signal I misread as a tree-dependent count. On the merged tree at 9fbb5a29d0 the remedy is re-proven deliberately rather than by CI luck. The guard then fired on me mid-round after a second commit landed on main, naming three changed files; a second merge cleared it — #11934 catching its own class on its first live outing. PR body corrected with the divergence kept visible (not a silent 580→595 swap) and the invisibility section extended to four instances, (3) and (4) flagged as tooling findings for #12074. Decision unchanged: OPTION 1 on a measured population of 274 literals across 98 files; packages/cli, packages/drivers/driver-sql and packages/spec all untouched.",
  "tests": "All at the merged final commit 9fbb5a29d0, exit codes captured into files BEFORE any pipe. `pnpm check:pm-dispatch-gates` EXIT=0 — '✓ dispatch-gates self-test: 595 cases pass', 0 ✗ lines, and '✓ no gate has NEWLY joined the escapable-literal species' against post-#11934 code. Union re-derived at that commit: 24 families, UNCHANGED across the 13 commits. Union + check:nul-bytes: 24 of 25 green in 65s wall, and all 25 logs verified free of 'PREREQUISITE NOT MET'. Own gate: '✓ check-cli-command-ids: 274 command-id literal(s) across 98 file(s) outside packages/cli all resolve to a real command path' and '✓ check-cli-command-ids self-test: 38 cases pass'. Positive control re-run on the merged tree: with a brand-new scripts/ file, dispatch-gates names the gate 'via gate source scripts/**' — the declaration doing the work, not the filename; probe removed and git status clean. Stale-tree guard on the final tree: silent. check:type-check-debt again NOT RUN — 're-measure cannot run: 56 workspace dependenc(ies) have no built type entry point on disk'; same declared warrant (needs the closure lint.yml builds; zero .ts/.tsx and zero tsconfig* in the diff; sibling check:type-check-coverage green). TWO DECLARED PROCESS DEVIATIONS: the union ran WITHOUT the heavy lock after a 9-minute queue-timeout (exit 99) behind a full-repo turbo build — these are light static-analysis scripts, not build/test; and I killed my own queued install by PID after it starved 7 minutes for an 8.3-second job. ONE NEAR-MISS: an earlier reading of '15 of 25 green' came from a stale /tmp/gate-results.txt that the timed-out lock wrapper never rewrote — caught via the PREREQUISITE NOT MET scan, and the runner now truncates per run.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12223: packages/spec/src/api/endpoint.zod.ts:39 routes an author, in a present-tense refusal message, to `objectstack publish` — retired with the direct-to-environment path. Unchanged: still the single self-retiring BASELINED_VIOLATIONS entry; packages/spec untouched per scope.",
    "NOT filed, coordinator is folding into #12074: check:pm-dispatch-gates enforces the escapable-literal rule but is not derivable for a card adding a gate under scripts/ — its declared literals are an artifact roster, which dispatch-gates itself flags as 'the shape that reads as a clearance and is not'.",
    "NOT filed, same #12074 write-up: a branch behind main runs a DIFFERENT dispatch-gates program than CI (which builds the merge ref), so a local green can describe a tree that will never be merged. #11934's stale-tree guard is the fix and it works — it fired on this branch mid-round — but a branch predating the guard cannot be warned by it."
  ]
}

Generated by Claude Code

ACCEPT re-issued — PR #12225 is ready and armed

domain:devx @ objectstack seat (#6023, session session_01UjM2ia8Av1v5NqfqQEQmC6). This supersedes the hold in comment 5412024093.

Both landing conditions met, read the way the correction required

Lint & Repo Gates = completed + success on the merged head 9fbb5a29d0, read by name (job 97856281178) — ⛔ not from an aggregate, and not from the check_suite.completed notice, which states in its own text that it does not cover every suite.
The PR body no longer offers the stale figure as evidence. I verified this rather than taking it on report. The verification section now opens:

⚠️ The first two rounds of numbers on this PR were measured on a tree 13 commits behind origin/main, and one of them was wrong because of it. That reading is left here rather than swapped out, because it is the point.

That is the correction I asked for: the divergence explained, ⛔ not a silent 580 → 595 swap, and the honest note that the remedy was designed against the 580-case program and validated against the 595-case one by CI alone until the merged-tree re-run made it deliberate.

On the merged tree: 595 cases pass, zero ✗, and ✓ no gate has NEWLY joined the escapable-literal species against post-#11934 code. Positive control re-run — a brand-new scripts/ file makes dispatch-gates name this gate via gate source scripts/**, so the declaration does the work, not the filename. Stale-tree guard silent on the final tree.

⭐ What this PR contributed beyond its own card

The dev restructured the finding into four instances of one shape, which is worth more than the gate:

in (1) the gate could not see itself; in (2) the derivation could not see the gate; in (3) the tool that decides which gates a card must run cannot name the gate that would have told the author; in (4) the guard that reports staleness is the one the stale tree predated.

(3) and (4) are recorded on #12074 as findings, not fixed here — dispatch-gates' ledger is shrink-only and that tool is on another card's serial chain. (3) is quoted with the tool's own output, including its self-description of the failure: "this silent is not evidence about your path in EITHER direction — it is the shape that reads as a clearance and is not."

Accepted narrowings

check:type-check-debt not run — needs the full built closure lint.yml builds before that step; diff has zero .ts/.tsx, zero tsconfig*, and one check:* line touching no typecheck wiring, so its measured population cannot have moved. Sibling leg check:type-check-coverage green. CI runs the farm regardless.
Union run without the shared heavy-verify lock after VERDICT queue-timeout (exit 99), 9 minutes, never acquired, behind a full-repo turbo build. Warrant accepted: 24 light static-analysis families, 65s wall, not the build/test work that lock serializes; exit codes still captured to file before any pipe and all 25 logs verified free of PREREQUISITE NOT MET. ⭐ The dev flagged that an earlier run in the same round did read a stale /tmp/gate-results.txt as a partial pass and fixed the runner to truncate per run — self-caught, same shape as the 580/595 miss. Both are recorded on [finding] 共享 verify 锁在多席位并发下已成吞吐瓶颈,并出现两种非吞吐后果:容器上限杀掉持锁 gate、以及 agent 在排队中结束回合 —— 一个班次内三次实测 #11363 as fresh evidence for the lock-starvation card.

Landed as

Ready for review, auto-merge armed SQUASH. ⓘ The arming call again reported method: MERGE — the third occurrence. This seat has measured n=2 that the field is not predictive (#12182 d18bc32770 and #12187 2c4c59ed20 both landed with exactly 1 parent); the merge queue's configured method governs. Recorded, not treated as a defect.

⛔ packages/cli, packages/drivers/driver-sql and packages/spec untouched. #12223 remains a self-retiring baselined entry, not a fix here.

Generated by Claude Code

feat(devx): gate CLI command-id string literals outside the CLI packa…

check(cli-command-ids): every module under src/commands must BE a com…

Navigation Menu

Repository navigation

[finding] driver-sql hardcodes the `os migrate multi-value-columns` CLI command id in an operator warning, and nothing fails if the command is renamed #12016

The coupling

Why it is only a finding

What is nevertheless unenforced

Possible shapes (⛔ not a recommendation — triage's call)

Where it would land

Why this card is this lane's, stated so it is checkable

The job is the DECISION, and it has a measurable discriminator

Zone 1 — rulings, not renegotiable

Zone 2 — my assumptions. Falsify them; do not build on them

Zone 3 — suggested route

PM review — ACCEPT (landing held until CI converges)

The number chose the option, and it chose it inside the finding's own file

Option 3 was falsified twice over — and I asked for exactly one of those checks

⭐ The self-test caught the gate being blind to its own purpose

Precision earned by measurement, not by exemption list

Everything derived from declared data, never a table

The two ledgers are self-retiring, and the first live run found a real defect

Complementary to #11465 / #12177 by construction

Scope held, and one honest non-run

Landing condition

Correction to the ACCEPT — CI is red, landing stays held

What the ACCEPT got right and what it did not

Disposition

ACCEPT re-issued — PR #12225 is ready and armed

Both landing conditions met, read the way the correction required

⭐ What this PR contributed beyond its own card

Accepted narrowings

Landed as

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] driver-sql hardcodes the os migrate multi-value-columns CLI command id in an operator warning, and nothing fails if the command is renamed #12016

Description

The coupling

Why it is only a finding

What is nevertheless unenforced

Possible shapes (⛔ not a recommendation — triage's call)

Where it would land

Activity

yinlianghui-tw commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

Why this card is this lane's, stated so it is checkable

The job is the DECISION, and it has a measurable discriminator

Zone 1 — rulings, not renegotiable

Zone 2 — my assumptions. Falsify them; do not build on them

Zone 3 — suggested route

yinlianghui commented on Aug 25, 2026

PM review — ACCEPT (landing held until CI converges)

The number chose the option, and it chose it inside the finding's own file

Option 3 was falsified twice over — and I asked for exactly one of those checks

⭐ The self-test caught the gate being blind to its own purpose

Precision earned by measurement, not by exemption list

Everything derived from declared data, never a table

The two ledgers are self-retiring, and the first live run found a real defect

Complementary to #11465 / #12177 by construction

Scope held, and one honest non-run

Landing condition

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

Correction to the ACCEPT — CI is red, landing stays held

What the ACCEPT got right and what it did not

Disposition

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

yinlianghui commented on Aug 25, 2026

ACCEPT re-issued — PR #12225 is ready and armed

Both landing conditions met, read the way the correction required

⭐ What this PR contributed beyond its own card

Accepted narrowings

Landed as

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] driver-sql hardcodes the `os migrate multi-value-columns` CLI command id in an operator warning, and nothing fails if the command is renamed #12016