test(objectql): sweep the dataset type, judged in a tenant that declares its object

[objectstack-fleet]

Fixes #19586 · one row, not the pattern: measured, no other harness in packages/objectql/src pays an empty-universe cost today (census below), and no shared seed could serve them, because each harness's universe is whatever its own fixtures name.

Clause-②: no

What changed

One file: packages/objectql/src/metadata-validation-sweep.test.ts, test-only.

• The dataset row is filled. It used to print dataset yes - - no fixture (skipped). It now reads dataset yes ok ok: a valid dataset is accepted and an invalid one is rejected.
• The harness universe gains the object the dataset is over. makeProtocol already seeded sweep_account_metrics (added for the report door in [rebuild of #19474] spec(lint): wire the inert runtime-create rules for action / hook / report / skill / email_template / mapping — six types, one edit (ruling #203/4 group A+C) #19542). It now also registers sweep_account through registry.registerObject, which the gate reads through listItems('object'). Without it the dataset fixture is refused object-reference-unknown, the wall [rebuild of #19474] spec(lint): wire the inert runtime-create rules for action / hook / report / skill / email_template / mapping — six types, one edit (ruling #203/4 group A+C) #19542's dev hit and reverted.
• The tenant is declared once. SWEEP_ACCOUNT and SWEEP_ACCOUNT_METRICS are named constants. makeProtocol seeds clones of them, and the object / dataset rows publish them as their valid documents, so the seeds cannot drift from the rows. They are deliberately not read out of FIXTURES: that spelling made removing the dataset fixture crash every row on the missing key, where the skip note should come back.
• The invalid leg now asserts which door refused. The runtime author-time gate throws the same envelope as the schema door (INVALID_METADATA, 422, issues[]), so the old check could not tell them apart. A refusal now counts only when it has no gate rule and a schema issue names the fixture's invalidatedField. Gate issues always carry rule and a stack-rooted path (datasets.NAME.object).
• The skill row's invalidatedField is now tools, not description. Measured: the schema's only issue on that payload is at tools, and description is optional. This relabel is the one row the new assertion forced.
• The report comment "the bound dataset is the fixture directly above" was false on main: it landed in spec(lint): wire the six inert runtime-create doors — action / hook / report / skill / email_template / mapping #19517 while the fixture it named was reverted. It is true again.

One row or the pattern: the census (at afc3b6492)

• 68 test files in packages/objectql/src reference ObjectStackProtocolImplementation / saveMetaItem. 9 of them both call saveMetaItem and carry an empty-universe mock (find resolving [], listItems: () => []).
• One of the 9 is this file. The other 8 (overlay-precedence, protocol-commit-history, protocol-destructive, protocol-lock-enforcement, protocol-meta-types-rich, protocol-meta, protocol-publish-package-drafts, protocol-registry-shadow) run 202/202 green with 0 authoring advisory lines and 0 *-unknown / *-unresolved rule ids. Control: the same log carries 19 other [Protocol] warn lines from the same dist, so an advisory would have shown.
• Widened to the whole package (304 files): 7 advisory lines, none from a reference-resolution rule (approval-expression-no-empty-policy x4, flow-multi-write-unfiltered x3, both body-shape rules), and 0 *-unknown / *-unresolved ids.
• So the pattern's cost is future only, paid when a later door opens, and it cannot be seeded ahead: each harness's universe is the names its own fixtures reference. Blind spot: the census matches the mock spellings named on the card. A harness that builds its engine with no registry at all would also have an empty universe, and would not be counted here, only covered by the package-wide advisory count above.
• packages/rest harnesses belong to domain:cli and are listed, not edited. Five carry the same mock spelling and drive saveMetaItem: meta-compound-save-force-parity, meta-compound-save-mode-parity, public-form-lookup-filter-lowering, public-form-lookup-picker, public-form-routes.stored-row. The two spec(lint): wire the six inert runtime-create doors — action / hook / report / skill / email_template / mapping #19517 already seeded are rest-server-meta-history-diff-org-scope and rest-server-meta-read-org-scope.

Evidence

All at b244ec482d unless marked.

• Before, afc3b6492: dataset yes - - no fixture (skipped).
• Card premise reproduced (fixture added, no object seed): dataset yes fail ok valid: INVALID_METADATA: dataset/sweep_account_metrics failed author-time validation: 1 issue — datasets.sweep_account_metrics.object [object-reference-unknown].
• After: every executed row ok ok. The invalid dataset's issues are exactly [{"path":"measures","message":"Invalid input: expected array, received undefined","code":"invalid_type"}], from the schema, no rule.
• Ablation (owed): remove the dataset fixture, and the skip note comes back. Run through scripts/ablation-replace.mjs --delete (WRAP mode, restore trap). Anchor 1 to 0, blob a9f40f14c53e to 3ff6f86a0252. Row: dataset yes - - no fixture (skipped); object / report still ok ok. Restored: blob equals HEAD a9f40f14c53e, git diff HEAD empty.
• Reverse check of the new assertion (one-off, not kept). The invalid dataset is made schema-valid but pointed at an undeclared object, so only the gate can refuse it.
  • (A) With the new check: dataset yes ok fail invalid: 422 is not the schema refusing \object`: [{"rule":"object-reference-unknown",...}]`, exit 1.
  • (B) Same fixture, check reverted to envelope-only: dataset yes ok ok, exit 0, a false pass.
  • Both legs were restored to blob equals HEAD, with git diff HEAD empty.
• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 304 files / 5072 tests passed, exit 0.
• pnpm --filter @objectstack/objectql typecheck: exit 0. check:test-typecheck OK (40 files / 234 errors, all in its ledger). This file is in tsconfig.test.json's program (--listFiles), has 0 error lines, and has no ledger entry.
• Gates: node scripts/pm/dispatch-gates.mjs --commands (no paths) derived 54 commands, and all 54 exit 0. Two first answered exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:type-check-debt); both went green after turbo run build --filter='./packages/*' --filter='./packages/*/*' (72/72). The dist sweeps were rerun at full population. --ran: 54 derived, 54 run, 0 NOT-MEASURED, 0 UNRUN, exit 0.
• Live node scripts/check-issue-citations.mjs: exit 0, no issue citations added ... (0 file(s) read). Test files are that gate's declared deferred surface, so this is not a clearance of the new citations. The two new targets were checked by hand: [finding] a runtime-created dataset reaches ZERO author-time rules — the type declares allowRuntimeCreate: true while nothing declares it in runtimeTypes and TYPE_TO_STACK_KEY has no row #19143 answers 200 (closed, completed) and [finding] the objectql metadata sweep skips dataset for want of a fixture, and adding one reds on a pre-existing empty-universe condition — the harness models a tenant with nothing in it #19586 answers 200.
• eslint, narrowed to the one file: --no-inline-config --format json: 1 file, 0 errors, 0 warnings. The file's resolved config (--print-config) has no parserOptions.project / projectService, so linting is not type-aware and the edit cannot move a verdict on any untouched file. The repo-wide pnpm lint is CI's.
• skip-changeset, measured: @objectstack/objectql ships files: [dist, README.md, CHANGELOG.md]. Five symbols unique to this diff (SWEEP_ACCOUNT_METRICS, invalidatedField, sweep_account_metrics, metadata-validation-sweep, the new note text) hit 0 files there, while the control class SchemaRegistry hits 2.

Bounded in-place fix, declared

The generic invalid-leg assertion and the skill relabel go beyond the one row. All four conditions hold:

1. It is the class this card hit: a sweep verdict produced by an author-time refusal instead of the schema, and skill was a live instance of a row refused for a reason other than the one it names.
2. It is mechanical, with its shape pinned by the measured issue list of every executed row.
3. No other claim holds this file.
4. It adds no new verification surface: the same test, the same gate family.

Acceptance notes (not filed)

• Seven other runtime-creatable types still print no fixture (skipped): book, datasource, doc, external_catalog, mapping, position, seed. Each is its own fixture, with its own universe to measure first. Triage graded this shape as a coverage gap, not a finding.
• Seven FIXTURES entries are never executed, because their types are not allowRuntimeCreate: field, validation, approval, job, profile, role, agent. That is the failure mode this file's own api note describes ("looking like coverage while asserting nothing"). Dead code, noted only.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8cbc3c0084a3c3c8ef5e59763ab3be96aa1a6f07 → packageMentionDocs.

[objectstack-fleet]

skip-changeset applied on the maintainer's instruction

domain:engine#1, session_01TEhopqrWQYBycZzyJHpAZr, written 2026-09-24T01:30Z.

Whose instruction, verbatim, where: the maintainer (huangyiirene), in this seat's session session_01TEhopqrWQYBycZzyJHpAZr (chat), answering the seat's standing question (card comment 5796043085 on #19586): 「给 #19857 加 skip-changeset」.

The PR changes one test file (packages/objectql/src/metadata-validation-sweep.test.ts); nothing in any package's files[] moves, so skip-changeset is the repo's mechanism for it. The dev session's own write of this label had been denied by its permission classifier, and the seat did not re-run it on the dev's behalf; this write rests on the maintainer's instruction. The seat applies the label now (additive write, read back), and lands the PR through the queue once Check Changeset re-runs green.

---

Generated by Claude Code