Both migration generators emit NOT NULL on a multiple: true column, which SqlDriver.createColumn returns before ever constraining — and the pin asserts the generator side

Found while implementing #16294 cause 3 (PR #17230), which repaired the column DEFAULT divergence between os generate migration and driver-sql. This is the same producer pair and the same "the generator should reproduce the platform" question, one property over — nullability on a multi-value column — and it is deliberately out of that PR's diff because repairing it contradicts a landed pin (see below).

⛔ Not graded or prioritised here. No labels applied, no assignee — this is for triage.

Driven, not read

Measured on a private PostgreSQL 16.13 cluster with the same harness #16294 used: all three producers run from ONE object and their columns read back out of information_schema.columns — driver-sql through its own initObjects, os generate migration --format sql through db.raw of the emitted DDL, and --format ts by importing the emitted module and calling up(db).

{ d_multi_notnull: { type: 'lookup', referenceTo: 'sys_user', multiple: true, storage: { notNull: true } } }

field              driver              sqlgen              tsgen               verdict
d_multi_notnull    null=YES default=-  null=NO  default=-  null=NO  default=-  DIVERGED

This was the ONE row still diverging in a 23-column defaultValue / nullability probe after #17230 — before it as well as after, i.e. #17230 neither caused nor repaired it.

Why

SqlDriver.createColumn short-circuits on the flag and returns before it reaches either the nullability line or the column DEFAULT:

    if (field.multiple) {
      this.jsonColumn(table, name);
      return;
    }

So the driver's multi-value column is nullable, always, whatever storage.notNull says. Both generators instead apply declaredNotNull(fieldDef) to their JSON column: the sql format emits "tags_nn" JSONB NOT NULL and the ts format table.jsonb('tags_nn').notNullable().

Consequence, in the same direction #16294's cause 2 named one property over: a table created from a generated migration constrains a column the platform's own table leaves open. An INSERT that omits the field is accepted by the platform's table and refused by both generated ones.

⚠️ Why it was NOT repaired under #16294

The current generator behaviour is pinned as intended — packages/cli/src/commands/generate-multiple-json-column.pin.test.ts:

  it('nullability comes from `storage.notNull`, not from the flag and not from `required`', () => {
    const constrained = { type: 'lookup', multiple: true, storage: { notNull: true } };
    ...
    expect(out).toContain('"tags_nn" JSONB NOT NULL');
    expect(ts).toContain("table.jsonb('tags_nn').notNullable();");
  });

That pin's stated subject (#14829) is "multiple does not decide nullability", and it was rewritten under #16318 when the vehicle moved from required to storage.notNull — but neither card measured the assertion against the DRIVER, which returns before the question is asked. So the pin encodes a rule the platform does not follow. Moving it is therefore a deliberate change to a landed pin, not a rider on an unrelated diff, and the direction is not free to pick by an executor: it is the same "which side moves" question #16318 answered for column TYPE and #17218 still carries for required.

The two sides

A — the generator follows the driver: drop the notNullable() / NOT NULL from the multi-value arm, and rewrite the pin to assert that a multi-value column is nullable on all three producers. Consistent with os generate migration's audit-stamp columns diverge from driver-sql — the generators emit NOT NULL where the driver emits nullable, and the SQL format emits TIMESTAMP where both knex paths yield timestamptz #15521's ruling ("the generator follows the driver") as applied by [finding] Both migration generators cap text fields at VARCHAR(255) while driver-sql creates an unbounded text column — a 300-char value the platform accepts is refused by every generated migration #16091, [finding] The NUMERIC column family diverges from driver-sql in both migration formats — driver real, generators numeric, and rating is real against integer #16318 and fix(cli): a generated migration carries the field-level unique index driver-sql creates #17208 to this same producer pair.
B — the driver is the one that is wrong: createColumn's early return means storage: { notNull: true } on a multi-value field is silently inert on the platform — a declared-but-unenforced key, which is the ADR-0049 enforce-or-remove shape. On this reading the repair belongs in driver-sql (honour the constraint on the JSON column) or in packages/spec (refuse the combination at authoring time), not in the generators.

⛔ Not answered here. Note the two sides land in different repos' worth of surface — A is domain:cli, B is domain:engine plus possibly a spec refusal — so the routing depends on the ruling.

Reproducing

One object with the field above, driven through all three producers into a live PostgreSQL 16.13 and read back from information_schema.columns. A postgresql-16 server package is present in the standard dev container, so a private cluster is initdb plus pg_ctl with no external service. The same divergence is visible without a server: PRAGMA table_info on three in-memory better-sqlite3 databases, the harness packages/cli/src/commands/generate-declared-column-default.pin.test.ts already uses.

Generated by Claude Code

Deferred this round — hard file serialisation behind #18172, ⛔ not a merit stop

domain:engine execution seat, session_01CqmCgU5RGDoJYhHUMVp2af, R1, 2026-09-17T08:48Z. This card is dispatchable and correctly graded; it is held only by a file collision, and the pits known at the moment of deferral are recorded below so the next round does not re-discover them.

Why it is held

#18172 was dispatched this round and lands in packages/drivers/driver-sql/src/sql-driver.ts. This card lands in the same file, at createColumn.

⛔ No region split was claimed, and that is deliberate. The two subjects look disjoint — this card is the createColumn DDL region, #18172 is the $contains lowering region — but this lane's charter allows a region release only from the other card's real change itinerary, which means reading its diff. #18172 has no PR yet, so its itinerary is UNKNOWN and the file serialises whole. ⭐ The charter's own reason: 「做删除的卡,其行程没人能从它加了什么的名字推出」 — a card's title does not bound the lines it touches.

This card is first in line on that file and goes out as soon as #18172's surface is known.

Pits known now — ⛔ re-measure, do not inherit

⚠️ The card body's quoted code no longer exists. Triage already caught this (5692034432): #17469 replaced if (field.multiple) with a call to isMultiValuedColumn. Re-measured on origin/main today — isMultiValuedColumn is defined at sql-driver.ts:1787 and used at :2513, :10587, :10593, with the #17469 reasoning recorded in the docblocks at :4775 and :4814. A patch written against the card's quoted spelling will not apply.
⚠️ The ground moved again AFTER the card was filed, and this is newer than triage's note. d285bf0fbc — fix(spec)!: refuse multiple: true outside the multi-capable types, and derive driver-sql's storage from the spec predicate (#18187), landed 2026-09-14, Fixes #17469 — makes driver-sql derive its storage decisions from isMultiValueField rather than reading the flag raw, under maintainer ruling 「one definition of multi-valued」 (director batch 🔗 Broken links detected in documentation #128 item 5, option 1′). ⇒ The predicate this card's repair keys off is now a spec-derived one. Whether that changes the shape of the fix is unmeasured and is the first thing the dispatch should ask.
⚠️ Adjacent, possibly overlapping card in this same queue: engine: the one-definition-of-multi-valued invariant reaches packages/objectql and driver-turso — the domain:engine half of #18199's ruling #18408 — 「the one-definition-of-multi-valued invariant reaches packages/objectql and driver-turso — the domain:engine half of [finding] the one-definition-of-multi-valued invariant #17469 restored stops at the driver-sql package boundary — os generate migration still emits JSONB where the driver now emits varchar (#14829 in reverse) #18199's ruling」. That is the continuation of the same fix(spec)!: refuse multiple: true outside the multi-capable types, and derive driver-sql's storage from the spec predicate #18187 ruling into other packages. ⛔ Whether it and this card touch the same seam is not yet established; establish it before the two are ever scheduled together.
⭐ The direction is already settled and is ⛔ not the executor's to re-pick. Triage's grading reads ADR-0113 plus the pin plus packages/spec as all pointing one way: the pin is right, the driver is the side out of line, and the repair is 「补实现,⛔ 不在消费端收窄」. ⛔ The pin is not to be weakened to match the driver.
⚠️ But that direction rests on a premise triage explicitly flagged as falsifiable first: does ADR-0113 intend multi-value / JSON columns to be in scope at all, or did the short-circuit predate and survive P0 deliberately? ADR-0113's own row 20 is the nearest counter-reading and must be answered rather than stepped over. If it falsifies ⇒ ⛔ stop, pm:retriage, ⛔ do not silently switch to relaxing the generators.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01CqmCgU5RGDoJYhHUMVp2af
Branch: claude/issue-17231-multivalue-notnull-createcolumn
Worktree: objectstack-issue-17231
Domain: domain:engine
Seat: domain:engine#1
File surface: packages/drivers/driver-sql/src/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (default judgement tier) — quoting this dispatch's own dispatch-gates.mjs --tier packages/drivers/driver-sql/src/sql-driver.ts: 「Model tier — no path-derived mandate … The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable).」 ⇒ default judgement tier: the card carries a premise triage explicitly marked falsify-first, and answering it is a judgement, ⛔ not a mechanical edit.
Clause-②: no
Thread-read: 5711606399
Serial constraints cleared: ⭐ The serial hold recorded on this card at 08:48Z is DISCHARGED. #18172 was the blocker on packages/drivers/driver-sql/src/sql-driver.ts; it terminated with premise_still_valid: false, pr: null and a branch carrying ZERO commits against origin/main (re-measured at claim time: git rev-list --count = 0), so its itinerary is now KNOWN and EMPTY. #17975 is dispatched in the same batch into packages/objectql/, disjoint; #18000 is in flight on packages/core/PHASE2_IMPLEMENTATION.md, disjoint. ⚠️ #18408 (packages/objectql + driver-turso, the domain:engine half of the same #18199 one-definition-of-multi-valued ruling) is OPEN and UNCLAIMED — it is NOT in flight, so it imposes no constraint today, but whether it shares this seam is UNESTABLISHED and must be established before the two are ever scheduled together.

Why `Clause-②: no`

The repair makes createColumn honour storage.notNull on the multi-value path, which is narrowing back to a declared contract (ADR-0113), ⛔ not widening one. 「拉回已声明契约不触条款②」. The DB-level effect is a column becoming constrained — a narrowing at the storage face, ⛔ not an enlarged accept set or public surface.

⚠️ If your measurement turns this into a widening — for instance if the only workable repair relaxes the generators instead — stop: that reverses an ADR and voids a landed pin. Report it, ⛔ do not re-grade the clause yourself.

The premise triage marked falsify-first — it is still the first thing to do

Carried because it governs whether this card is dispatchable at all:

Assumption: honouring storage.notNull on the multi-value path is 「拉回已声明契约」 … therefore ⛔ not the human floor, therefore dispatchable.
Falsify it by asking: does ADR-0113 intend multi-value/JSON columns to be in scope at all, or did the short-circuit predate and survive P0 deliberately?

⇒ If it falsifies: ⛔ stop, ⛔ do not force it, hang pm:retriage. ⛔ Do not silently switch to relaxing the generators.

Pits re-measured by this seat at claim time — ⛔ re-verify on your base, do not inherit

⚠️ The card body's quoted if (field.multiple) no longer exists. isMultiValuedColumn is defined at sql-driver.ts:1787, used at :2513, :10587, :10593; the #17469 reasoning sits in docblocks at :4775 and :4814.
⚠️ Newer than triage's note: d285bf0fbc — fix(spec)!: refuse multiple: true outside the multi-capable types, and derive driver-sql's storage from the spec predicate (#18187), landed 2026-09-14, Fixes #17469 — makes driver-sql derive storage decisions from isMultiValueField rather than reading the flag raw, under maintainer ruling 「one definition of multi-valued」 (director batch 🔗 Broken links detected in documentation #128 item 5, option 1′). The predicate your repair keys off is now spec-derived. Whether that changes the fix's shape is unmeasured and is the first thing to establish after the falsification above.
⭐ Line numbers rot within hours in this file — locate by symbol, never by the numbers above.

Generated by Claude Code

os-dev-report

{
  "issue": 17231,
  "status": "done",
  "branch": "claude/issue-17231-multivalue-notnull-createcolumn",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18630",
  "session": "session_01CqmCgU5RGDoJYhHUMVp2af",
  "premise_still_valid": true,
  "files_changed": [
    "packages/drivers/driver-sql/src/sql-driver.ts",
    "packages/drivers/driver-sql/src/sql-driver-17231-multi-value-not-null.test.ts",
    ".changeset/17231-multi-value-column-storage-notnull.md"
  ],
  "summary": "Falsification first, and it did NOT falsify: ADR-0113 carves out no field type (D2 is unconditional, and the words multiple/JSON/array appear nowhere in the record), the declaration parses green at the spec entrance (its only declared exclusivity is requiredWhen), and ADR-0113 is ALREADY implemented as in-scope for JSON columns at its other named consumer in this package - diffManagedTable compares storage.notNull for every field fieldHasColumn accepts, and that predicate answers multi-value first. The nearest counter-reading (the classifier's destructive class) is about an EXISTING column, while createColumn only ever runs on CREATE TABLE and ALTER TABLE ADD COLUMN, i.e. on an empty column. So the driver was the side out of line and the repair is in driver-sql: createColumn's multi-value short-circuit now applies the ADR-0113 nullability decision before its early return, keeping the JSON column type. The constraint predicate is stated once (declaresColumnNotNull) and asked at both of createColumn's exits, with the tail's truthiness test unchanged. R2 re-measured: the spec-derived predicate (isMultiValuedColumn -> isMultiValueField, after #18187) did NOT change the shape of the fix - the repair sits inside that branch and reads the same predicate. R1 re-measured: located by symbol, never by the rotted line numbers. No packages/cli file changed; the pin is untouched and still reads its two landmarks in the pre-switch window. The column DEFAULT stays unemitted on this path, matching os generate migration's own recorded reason.",
  "gates": {
    "derivation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, at merged HEAD c20356f0e1 (no STALE TREE warning); 61 families derived from the 3 real changed paths",
    "reconciliation": "--ran with per-family exit codes: 61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero - every family recorded an exit code and none is 3)",
    "green": 60,
    "red": 1,
    "red_detail": "pnpm check:cross-package-test-inputs :: exit 1 - NOT from this diff. Control: a detached worktree at pristine origin/main (d5e64d8d9d) exits 0 as checked out, and exits 1 with the identical message after a bare mkdir -p packages/spec/dist/chunks and nothing else. Its walked-root limb reads the filesystem (uncoveredWalkRadius -> readdirSync), so the same tree passes before a build and fails after one.",
    "prerequisite_gates_measured_after_full_build": "check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt all exited 3 (PREREQUISITE NOT MET) until turbo build over ./packages/* ran (72/72 successful); re-run afterwards they exit 0. Recorded as measured, not as a skip."
  },
  "tests": "ALL through scripts/pm/os-verify-lock.sh (OS_VERIFY_LOCK_SLOT=os-dev-17231), verdicts read off the VERDICT command-exit line, exit codes captured before any pipe. RED-BEFORE on base 21b7c12b4f: the new suite reported 3 failed | 6 passed | 2 skipped - the subject (expected true to be false), the INSERT refusal (promise resolved instead of rejecting), and the creator/differ parity, which returned [{kind:'nullability_mismatch', column:'multi_nn', expected:'NOT NULL', actual:'NULL', category:'destructive', op:{type:'tighten_not_null'}}] against a table the driver had just created with no rows in it. CONTROLS FIRED IN BOTH RUNS: scalar_nn (a scalar carrying the same storage.notNull) reads NOT NULL, scalar_plain reads nullable, multi_plain and multi_req stay nullable, and the constrained multi-value column keeps the unconstrained one's column type - so the green afterwards is a reading, not a blind harness. GREEN-AFTER: 9 passed | 2 skipped. Full package: pnpm --filter @objectstack/driver-sql test = 178 files passed, 11 skipped / 2627 tests passed, 168 skipped (exit 0) at merged HEAD c20356f0e1; typecheck exit 0, and tsc --noEmit --listFiles names the new suite exactly once, so the typecheck really covers it. SKIPPED DIALECT CELLS, declared and never reported as a pass: live postgres (OS_TEST_POSTGRES_URL unset) and live mysql (OS_TEST_MYSQL_URL unset). Only sqlite executed locally. Both are executed by the required Temporal Conformance (live PG + MySQL) job, which runs the whole driver-sql suite against both servers with OS_EXPECT_LIVE_DIALECT_MATRIX=1, where an unprovisioned cell is a named red rather than a skip. No ablation was performed: the red-before/green-after pair on a committed fix is the measurement this card needed, and no new guard was added whose failure mode needed proving. eslint (declared narrowing): eslint --no-inline-config --format json over the 2 changed source files = 2 files, 0 errors, 0 warnings at c20356f0e1. Population from eslint's own base block (**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}), so the .changeset/*.md path is outside it; count from the JSON reporter's array; invariance because this repo's single eslint.config.mjs never enables type-aware linting for ANY file. AGENTS.md section 10: origin/main merged (clean, no os-regen-pending), spec rebuilt, pnpm --filter @objectstack/spec check:generated = All 15 generated artifacts are up to date.",
  "line_budget": "n/a - no skills/** path in the diff, so no published-skill line budget applies.",
  "deviations": [
    "Repo-scale pnpm lint not run locally (CI owns it). Replaced by a DECLARED narrowing with its three pieces of evidence, stated in the PR body and in `tests` above.",
    "Live postgres and live mysql cells of the new suite are SKIPPED locally (unprovisioned URLs). Declared, not counted as passes; the required Temporal Conformance job executes them.",
    "Historical leg of the falsification (did the short-circuit survive P0 deliberately?) is NOT MEASURED: the checkout is shallow (500 commits) and both git log -S probes collapse onto the shallow boundary commit. The conclusion does not rest on it - the differ's existing behaviour is the decisive reading.",
    "Write-budget conflict, reported rather than silently resolved: this dispatch budgeted two REST writes (POST /pulls, POST /issues/17231/comments) while .claude/agents/os-dev.md budgets four, including a labels write. Resolved as two: no label was owed here - the size/tests/tooling labels are the labeler workflow's, skip-changeset is false because a changeset ships, and needs:contract-review belongs to the seat."
  ],
  "mcp_calls": "0 - no MCP GitHub tool was called, read or write. All GitHub traffic was curl against the REST proxy.",
  "api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (draft PR 18630) and POST /repos/objectstack-ai/objectstack/issues/17231/comments (this report). No PATCH, no labels write, no MCP write tool.",
  "open_questions": [],
  "out_of_scope_findings": [
    "to file (class (a), reproducible defect; dedupe words: cross-package-test-inputs, uncoveredWalkRadius, walked root, packages/spec/dist, build-state dependent): check:cross-package-test-inputs passes or fails on the SAME tree depending on whether packages/spec/dist/ exists on disk. Two legs on a detached worktree at pristine origin/main d5e64d8d9d: as checked out, exit 0 ('OK: 29 package(s) read outside themselves, all declared'); after nothing but mkdir -p packages/spec/dist/chunks, exit 1 flagging '@objectstack/cli descends a directory tree from packages/spec/dist/ ... rooted in packages/cli/test/init-created-files-summary.e2e.test.ts'. Cause: the walked-root limb resolves a folded walk root only if it names a real directory and then judges its radius with readdirSync, so a developer who has built sees a red that CI's unbuilt lint job does not. Owner: whoever owns scripts/check-cross-package-test-inputs.mjs plus packages/cli's test - both outside this card's file surface.",
    "noted, not filed: none. createColumn's other early exits were read while establishing the two-exit shape and none of them owes the nullability line (formula emits no column; the string/text/file arms fall through to the shared tail)."
  ]
}

Generated by Claude Code

os-dev-report

{
  "issue": 17231,
  "status": "done",
  "round": "patch-1 (CI red on Temporal Conformance, head c20356f0e1)",
  "branch": "claude/issue-17231-multivalue-notnull-createcolumn",
  "head": "dd723b6dbc",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18630",
  "session": "session_01CqmCgU5RGDoJYhHUMVp2af",
  "premise_still_valid": true,
  "files_changed": [
    "packages/drivers/driver-sql/src/sql-driver.ts",
    "packages/drivers/driver-sql/src/sql-driver-17231-multi-value-not-null.test.ts",
    ".changeset/17231-multi-value-column-storage-notnull.md"
  ],
  "patch_round": {
    "what_the_failure_actually_was": "MY test, not the product, and exactly the cell nobody had run. Step 12 of the job ('Run driver-sql suite against both live servers') is the failing step - steps 13-16 are skipped, so the metadata-protocol leg never ran. The failing assertion is the INSERT-refusal leg of sql-driver-17231-multi-value-not-null.test.ts in the live mysql cell. MySQL DID refuse the write, in a third vocabulary my regex did not carry: the driver's statement omits the column entirely (insert into `os17231_multi_notnull` (`id`, `scalar_nn`) values (...)), so SQLite and PostgreSQL substitute the column's implicit NULL and report the constraint ('NOT NULL constraint failed', 'null value in column ... violates not-null constraint') while MySQL in strict mode refuses the OMISSION before a NULL is ever considered: ER_NO_DEFAULT_FOR_FIELD, \"Field 'multi_nn' doesn't have a default value\". One behaviour, three spellings.",
    "is_the_product_wrong": "No. All three dialects refuse the omitting INSERT, which is the fact the card is about, and the multi-value column comes out NOT NULL on all three. No driver change was needed and none was made in this round - sql-driver.ts is byte-identical to the commit CI graded.",
    "local_reproduction_matched": "Yes, exactly, and it was reproduced BEFORE anything was changed. Provisioned to CI's own conditions: a private PostgreSQL 16.13 cluster (initdb + pg_ctl, port 54317, ALTER SYSTEM SET timezone='Asia/Shanghai' - CI's step 4 setting) and a private MySQL 8.0.46 (apt mysql-server, port 33317, default_time_zone='+08:00', database 'conformance'), process TZ=America/New_York, OS_EXPECT_LIVE_DIALECT_MATRIX=1. The targeted run reproduced 1 failed | 15 passed with the identical assertion text CI would have printed.",
    "eliminated_by_measurement": "The coordinator's PG hypothesis: REFUTED. Before any edit, the full driver-sql suite against live PostgreSQL under CI conditions was 186 files passed, 3 skipped / 3315 passed, 85 skipped, exit 0 - the PG half of the job was already clean, and my suite's PG cell passed 16/16. A first PG run without the zone skew failed 4 files on the harness's own non-vacuity guard (assertThreeWayZoneSkew: 'the live postgres server runs at UTC'); that was my cluster, not the code, and it is why the cluster was restarted at Asia/Shanghai.",
    "the_fix": "Test-only, one assertion. The refusal is now keyed per dialect cell (REFUSAL_BY_DIALECT: sqlite /NOT NULL constraint failed/, pg /null value in column .* violates not-null constraint/, mysql /doesn't have a default value|cannot be null/) rather than one alternation widened until it matches anything - so a refusal arriving for some other reason (a connection fault, a tenancy error) still reddens the test. A dialect-independent leg was added beside it: the table's row count is unchanged across the rejection, which is the fact the card is actually about - the write did not land. NOTHING was skipped, disabled or quarantined; the assertion that ran and failed now runs and passes on the server that failed it.",
    "blocked_read": "The full CI log is unreachable from this session: GET /actions/jobs/105163653092/logs redirects to productionresultssa18.blob.core.windows.net, which the egress proxy answers 403 (policy denial). Not retried or routed around. The per-step conclusions from GET /actions/jobs/105163653092 are what localised the failure to step 12."
  },
  "tests": "All through scripts/pm/os-verify-lock.sh, verdicts read off the VERDICT command-exit line. TIERS: driver-sql has no vitest project tiers - `pnpm test` is `vitest run` over the whole package, and the live cells are gated by URL env vars, so the tier here IS the dialect matrix. REPRODUCTION (pre-fix, live mysql provisioned): 1 failed | 15 passed | 1 skipped (17). AFTER, targeted, all three cells with OS_EXPECT_LIVE_DIALECT_MATRIX=1: 23 passed | 0 skipped (23) - 2 entrance tests plus 7 per cell x 3 cells (sqlite, live postgres, live mysql). AFTER, THE JOB'S OWN POPULATION - full driver-sql suite against BOTH live servers, TZ=America/New_York, PG timezone=Asia/Shanghai, MySQL default_time_zone='+08:00', OS_EXPECT_LIVE_DIALECT_MATRIX=1: 189 files passed | 0 failed, 4017 tests passed | 1 skipped (4018), exit 0. The single skip is pre-existing and not a dialect cell: schema-drift.base-type-mismatch.test.ts > 'the remedy the finding prints actually works, and clears the finding' (sqlite). Every cell of the live matrix executed. typecheck: pnpm --filter @objectstack/driver-sql typecheck exit 0. GATES at dd723b6dbc: families re-derived (identical set, 61) and all 61 re-run - 60 green, 1 red (check:cross-package-test-inputs, the same build-state-dependent red proven pre-existing on pristine origin/main last round). check:dual-build-cjs-loads, check:lean-entry-closure and check:type-check-debt were re-measured green after a full turbo build at this head (72/72 tasks successful), not left at exit 3. eslint narrowing re-run at dd723b6dbc: 2 files, 0 errors, 0 warnings.",
  "deviations": [
    "PR BODY IS NOW PARTLY SUPERSEDED AND WAS NOT PATCHED. Its section 'Dialect cells SKIPPED here' says only sqlite executed locally and that nothing claims a Postgres or MySQL reading. That was true at c20356f0e1; at dd723b6dbc both live cells have been executed locally and pass. The body was left alone deliberately - this seat's write budget forbids PATCHing a body, and re-sending one risks the appended-footer duplication AGENTS.md warns about. This comment is the durable correction; the seat can fold it in when it takes the PR out of draft.",
    "Container footprint, reported rather than hidden: mysql-server 8.0.46 was installed from the Ubuntu archive (apt) in this shared container - no MySQL was present and no docker daemon is available. Both servers were started on non-default ports (PG 54317, MySQL 33317) and have been STOPPED; only the PIDs this session recorded were signalled, and a read-only process listing confirms no mysqld or postgres remains. The PG data directory was removed; the mysql package is left installed (removing it could disturb a sibling that has since started using it).",
    "Cluster data directories lived under /tmp/os17231-* rather than the scratchpad: /tmp/claude-0 is mode 0700 root, so the postgres and mysql service users cannot traverse into it. Both paths are issue-prefixed and the PG one is deleted."
  ],
  "mcp_calls": "0 - no MCP GitHub tool was called in either round. All GitHub traffic was curl against the REST proxy.",
  "api_writes": "1 this round - POST /repos/objectstack-ai/objectstack/issues/17231/comments (this report). 3 cumulative on this card: POST /pulls, and two report comments. No PATCH, no labels write, no MCP write tool.",
  "open_questions": [],
  "out_of_scope_findings": [
    "unchanged from the first report - to file (class (a); dedupe words: cross-package-test-inputs, uncoveredWalkRadius, walked root, packages/spec/dist, build-state dependent): check:cross-package-test-inputs passes or fails on the SAME tree depending on whether packages/spec/dist/ exists on disk; two legs on a detached worktree at pristine origin/main reproduce both verdicts.",
    "noted, not filed: MySQL's ER_NO_DEFAULT_FOR_FIELD wording is a dialect fact, not a defect - the driver omits the column on every dialect and every dialect refuses the write. No asymmetry to file. Successor: none."
  ]
}

Generated by Claude Code

os-dev-report reviewed (delivery + one patch round) — ACCEPT. PR #18630 goes ready and into the merge queue.

domain:engine execution seat, session_01CqmCgU5RGDoJYhHUMVp2af, R1, 2026-09-17T11:11Z. Reports: 5712717646 (delivery) and 5713337146 (patch round). ⛔ Verified against GitHub and the tree — ⛔ not against the reports' own account of themselves.

The falsification ran, and did NOT falsify

Triage flagged one premise as falsify-first, and the answer is better than a yes:

ADR-0113 carves out no field type. D2 is unconditional, and the words multiple / JSON / array appear nowhere in the record.
The nearest counter-reading is out of range. The classifier's destructive class is about an existing column; createColumn only ever runs on CREATE TABLE and ALTER TABLE ADD COLUMN — an empty column. ⇒ ⛔ The counter-reading cannot reach this path.
⭐ The decisive reading, and it is the one this seat would not have thought to ask for: ADR-0113 is already implemented as in-scope for JSON columns at its other named consumer in this same package — diffManagedTable compares storage.notNull for every field fieldHasColumn accepts, and that predicate answers multi-value first. ⇒ Two paths in one package gave two answers to one ADR, and the driver was the one out of line.

The CI red — root-caused, and it was the TEST, ⛔ not the product

Temporal Conformance (live PG + MySQL) went red at c20356f0e1. This seat established it was this PR's by the cheapest discriminator (the same check on the base was success, with zero non-green on the base head), then handed it back with the one candidate it could see already eliminated — the os11565_narrow InnoDB row-size error appears verbatim on the green base run too.

The dev found it, in the cell nobody had run:

MySQL refuses the omitting INSERT in a third vocabulary. The driver omits the column on every dialect; SQLite and PostgreSQL substitute the implicit NULL and report the constraint, while MySQL in strict mode refuses the omission before a NULL is ever considered — ER_NO_DEFAULT_FOR_FIELD, 「Field 'multi_nn' doesn't have a default value」. One behaviour, three spellings.

⭐ This seat's own hypothesis was refuted in passing and that is recorded: it offered PG and MySQL as the two unrun cells. The PG half was measured already clean — 186 files / 3315 tests passed against live PostgreSQL, exit 0, the suite's PG cell 16/16. ⛔ Only the MySQL half was real.

Verified by this seat, ⛔ not taken on trust

claim	reading
the product did not change in the patch round	✅ `sql-driver.ts` sha256 `5de174652a3515e2` at both `c20356f0e1` and `dd723b6dbc` — byte-identical
the fix is not a widened regex	✅ `REFUSAL_BY_DIALECT` keys three distinct patterns per cell (`:121-124`), plus a dialect-independent row-count leg at `:213`
`Temporal Conformance` is now green	✅ `completed` / `success` at `dd723b6dbc`
whole-PR CI	✅ 0 non-green
skipped vs roster	5/5 on `EXPECTED_SKIPS`
path face via `get_files`	3 files, no governed-surface hit
form	draft · base `main` · `Fixes #17231` line 1 · `Clause-②: no` at column 0

⭐ Why the repair shape matters more than the green. Widening one alternation until it matches would also have swallowed a refusal arriving for some other reason — a connection fault, a tenancy error — and the test would have stayed green through it. Keying per dialect keeps the test able to fail. ⛔ Nothing was skipped, disabled or quarantined; the assertion that ran and failed now runs and passes on the server that failed it.

Verification ran the JOB'S OWN POPULATION, ⛔ not a convenient subset

The dev provisioned CI's conditions locally — PostgreSQL 16.13 at timezone='Asia/Shanghai' (CI's step-4 setting), MySQL 8.0.46 at default_time_zone='+08:00', process TZ=America/New_York, OS_EXPECT_LIVE_DIALECT_MATRIX=1 — and ran the full driver-sql suite against both live servers: 189 files passed | 0 failed, 4017 passed | 1 skipped, exit 0. The single skip is pre-existing and ⛔ not a dialect cell.

⭐ And the reproduction came before the fix, matching CI's assertion text exactly. ⛔ Not a speculative push.

⚠️ One false start is recorded rather than buried: a first PG run failed 4 files on the harness's own non-vacuity guard (assertThreeWayZoneSkew: 「the live postgres server runs at UTC」). That was the dev's cluster, ⛔ not the code — and it is the guard doing its job.

Body correction, made by this seat at landing

The body's 「Dialect cells SKIPPED here」 section was true at c20356f0e1 and false at dd723b6dbc. The dev declined to patch it on write-budget grounds and handed it over explicitly — the right call. This seat corrected it, marked as superseded rather than retracted, with the report comment named as the durable record.

⚠️ And this seat hit the hazard it filed as #18622 while doing so: the original footer carried the session-URL form, my strip pattern matched only the bare form, so the edit left two footers. Fixed by stripping every form and letting the platform append exactly one; the session id now lives in body prose, which is #18622's own prescribed remedy. ⭐ Recorded because a card's author walking into the card's own trap is the strongest evidence it is worth fixing.

Findings

⛔ No twin card. The dev's check:cross-package-test-inputs finding is the same one already filed as [finding] check:cross-package-test-inputs exits 0 or 1 on the same commit depending on whether a dist/ exists — and lint.yml runs it with no build ahead of it, so CI only ever sees the blind leg #18621; its bare-mkdir control is the sharpest of the three and is already recorded there.
⏹️ MySQL's ER_NO_DEFAULT_FOR_FIELD wording is a dialect fact, ⛔ not a defect — every dialect refuses the write. Correctly not filed.
⏹️ seed-loader.ts's as any casts over SEED_OPTIONS: not class (a)/(b)/(c), correctly not filed, named carrier recorded.

Deviations — all accepted

The third REST write (labels) and the commit-trailer conflict were flagged rather than absorbed, which is what made both visible; both are now recorded as standing frictions on the seat post (5713135981), and the under-budgeted write allowance was this seat's defect, corrected mid-round. The container footprint (a mysql-server install, both servers stopped, PG data directory removed) is reported in full.

mcp_calls 0 · REST writes 3 cumulative. ⛔ No denied-roster tool was called.

⇒ Ready + auto-merge (SQUASH). This seat follows it to MERGED.

Generated by Claude Code

MERGED — verified by two readings with a firing AND a dark control

domain:engine execution seat, session_01CqmCgU5RGDoJYhHUMVp2af, R1, 2026-09-17T11:40Z. PR #18630 landed; auto-close residue cleared in the same pass.

Reading 1 — the fix on origin/main, located by symbol.


`declaresColumnNotNull` — the constraint predicate stated once and asked at both `createColumn` exits	4
the new pin file `sql-driver-17231-multi-value-not-null.test.ts`	present
`REFUSAL_BY_DIALECT` — the per-dialect keying	2
⭐ firing control — `isMultiValuedColumn`, which must already exist	21
⭐ dark control — a fabricated predicate name	0

⇒ Both controls fired in the directions they had to. A grep that returns 21 for a real symbol and 0 for an invented one is discriminating, so the four hits above are a reading.

Reading 2 — the landing commit. 32be735e5b — fix(driver-sql): honour storage.notNull on the multi-value column, the ADR-0113 site it returned above (#18630). Parent count = 1 ⇒ squash.

Residue cleared: pm:dispatched dropped, assignee released, one write, read back. Card auto-closed completed.

What this card is worth remembering for

⭐ The falsification ran and did not falsify, on a reading nobody had asked for. The decisive evidence was not in ADR-0113's text but in the tree: ADR-0113 was already implemented as in-scope for JSON columns at its other consumer in this same package (diffManagedTable compares storage.notNull for every field fieldHasColumn accepts, and that predicate answers multi-value first). ⇒ Two paths in one package answered one ADR two ways; the driver was the one out of line.
⭐ The counter-reading was disposed of by scope, ⛔ not by argument. ADR-0113 row 20's destructive class is about an existing column; createColumn only runs on CREATE TABLE / ALTER TABLE ADD COLUMN — an empty one. It could not reach this path.
⭐ The CI red was the test, ⛔ not the product, and the root cause is a dialect fact worth keeping: MySQL strict mode refuses the omission (ER_NO_DEFAULT_FOR_FIELD) before a NULL is ever considered, where SQLite and PostgreSQL substitute the implicit NULL and report the constraint. One behaviour, three spellings. sql-driver.ts was byte-identical across the red and the fix.
⭐ The repair kept the test able to fail. Keying the refusal per dialect, rather than widening one alternation until it matched, means a refusal arriving for some other reason — a connection fault, a tenancy error — still reddens it. ⛔ Nothing was skipped, disabled or quarantined.
⚠️ This seat's hypothesis was refuted in passing: the PG cell was measured already clean (186 files / 3315 tests, exit 0). Only the MySQL half was real.

⚠️ The Temporal Conformance (live PG + MySQL) job is worth knowing about for any future driver-sql card: it runs the whole driver-sql suite against both live servers with OS_EXPECT_LIVE_DIALECT_MATRIX=1, under which an unprovisioned cell is a named red, ⛔ not a skip. ⇒ A card that adds a live-matrix cell has not been verified until that job has run it, however green the local run was.

Generated by Claude Code

fix(driver-sql): honour storage.notNull on the multi-value column, th…

Navigation Menu

Repository navigation

Both migration generators emit NOT NULL on a `multiple: true` column, which `SqlDriver.createColumn` returns before ever constraining — and the pin asserts the generator side #17231

Driven, not read

Why

⚠️ Why it was NOT repaired under #16294

The two sides

Reproducing

Deferred this round — hard file serialisation behind #18172, ⛔ not a merit stop

Why it is held

Pits known now — ⛔ re-measure, do not inherit

Why `Clause-②: no`

The premise triage marked falsify-first — it is still the first thing to do

Pits re-measured by this seat at claim time — ⛔ re-verify on your base, do not inherit

The falsification ran, and did NOT falsify

The CI red — root-caused, and it was the TEST, ⛔ not the product

Verified by this seat, ⛔ not taken on trust

Verification ran the JOB'S OWN POPULATION, ⛔ not a convenient subset

Body correction, made by this seat at landing

Findings

Deviations — all accepted

MERGED — verified by two readings with a firing AND a dark control

What this card is worth remembering for

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Both migration generators emit NOT NULL on a multiple: true column, which SqlDriver.createColumn returns before ever constraining — and the pin asserts the generator side #17231

Description

Driven, not read

Why

⚠️ Why it was NOT repaired under #16294

The two sides

Reproducing

Activity

huangyiirene commented on Sep 17, 2026

Deferred this round — hard file serialisation behind #18172, ⛔ not a merit stop

Why it is held

Pits known now — ⛔ re-measure, do not inherit

huangyiirene commented on Sep 17, 2026

Why Clause-②: no

The premise triage marked falsify-first — it is still the first thing to do

Pits re-measured by this seat at claim time — ⛔ re-verify on your base, do not inherit

huangyiirene commented on Sep 17, 2026

huangyiirene commented on Sep 17, 2026

huangyiirene commented on Sep 17, 2026

The falsification ran, and did NOT falsify

The CI red — root-caused, and it was the TEST, ⛔ not the product

Verified by this seat, ⛔ not taken on trust

Verification ran the JOB'S OWN POPULATION, ⛔ not a convenient subset

Body correction, made by this seat at landing

Findings

Deviations — all accepted

huangyiirene commented on Sep 17, 2026

MERGED — verified by two readings with a firing AND a dark control

What this card is worth remembering for

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Both migration generators emit NOT NULL on a `multiple: true` column, which `SqlDriver.createColumn` returns before ever constraining — and the pin asserts the generator side #17231

Why `Clause-②: no`