test(spec): the last data/ file group's test titles state each cited decision in words instead of a tracker number (stage 19)

[objectstack-fleet]

Part of #20749
Clause-②: no

Stage 19 of this card: the next area of class (e), the test strings shipped under packages/spec/src, as ruled in 5902360492 on #20513. This stage takes the last data/ group: the name-ordered test files directly under packages/spec/src/data/ from query-transport.test.ts to validation.test.ts, plus data/driver/. Those 18 files carried 82 messages and 86 tracker ids, citing 39 records. Every one of those ids now either states what its record decided, in words (form D), or is dropped where the title already says it. Text only: no assertion, identifier, test count or code comment changes. After this PR data/ carries no tracker id in a test string.

Census at the base (124533b388)

Instruments: census10.cjs (md5 9d08602ab972b4b8643c90d64d40fa41), census.cjs (md5 6e42a45a926d375013c32d62f16a296e), census-wide.cjs (md5 c98410a19529c439adb0afbfb00026a2) and dirtable.cjs (md5 dda605c54745b4a60cc14c9a686e4eff). They are byte-identical to the copies stages 10 to 18 used. A literal counts as a test title when its folded message is argument 0 of a describe / it / test call, .each / .skip / .only chains included. Everything else is an "other" string.

The base is 124533b388, the claim's base and stage 18's landing. Both instruments read 942 messages / 994 ids in 208 files, the seat's reading and stage 18's head reading.

directory	files	messages / ids	titles	other
ui/	84	396 / 419	378 / 401	18 / 18
api/	40	189 / 201	181 / 193	8 / 8
system/	34	154 / 165	128 / 138	26 / 27
(files directly in src/)	30	118 / 120	117 / 119	1 / 1
data/ (this PR)	18	82 / 86	81 / 85	1 / 1
ai/	1	2 / 2	0	2 / 2
contracts/	1	1 / 1	0	1 / 1
total	208	942 / 994	885 / 936	57 / 58

The group reads 82 messages / 86 ids in 18 files, the seat's figures, file for file: 11 files directly under data/ (34 ids) and 7 in data/driver/ (52 ids).

file (under data/)	messages / ids	titles	other
driver/config-registry.test.ts	3 / 3	3 / 3	0
driver/driver-credential-refusal.test.ts	27 / 30	27 / 30	0
driver/driver-placeholder-refusal.test.ts	9 / 10	9 / 10	0
driver/memory.test.ts	1 / 1	1 / 1	0
driver/pg-url-grammar.test.ts	2 / 2	2 / 2	0
driver/postgres.test.ts	3 / 3	3 / 3	0
driver/turso.test.ts	3 / 3	3 / 3	0
query-transport.test.ts	5 / 5	5 / 5	0
query.test.ts	11 / 11	10 / 10	1 / 1
record-surface.test.ts	2 / 2	2 / 2	0
search-fields.test.ts	6 / 6	6 / 6	0
secret-mask.test.ts	1 / 1	1 / 1	0
seed.test.ts	1 / 1	1 / 1	0
tree-reference-self-only.test.ts	1 / 1	1 / 1	0
unique-scope-message.test.ts	1 / 1	1 / 1	0
unique-scope.test.ts	1 / 1	1 / 1	0
validation-boundary-description.test.ts	4 / 4	4 / 4	0
validation.test.ts	1 / 1	1 / 1	0
18 files	82 / 86	81 / 85	1 / 1

The one "other" string is the expect message at query.test.ts:202, declared to the text-only tool. Three more test files sit in the same name range and carry no id: seed-loader, type-compat and driver/mongo. They are not touched.

• Controls. Lit: ui/dashboard.test.ts, outside the group, reads 21 ids at the head as at the base. Dark: search-fields.test.ts and driver/driver-credential-refusal.test.ts read 0 at the head while 16 and 29 of their comment lines still carry a number. Planted in scratch copies of head files: an id put into a seed.test.ts title reads 1 / 1, and an id put into a secret-mask.test.ts comment reads 0.
• A wider pattern (any # plus digits) reads the same totals as the gate pattern in all 18 files at the base, and 0 in all 18 at the head.
• At the head: 860 messages / 908 ids in 190 files. The 18 files read 0 / 0, data/ reads 0 / 0, and no other file moved.

How the area was chosen

data/ has been taken in name-ordered file groups near the ~100-id bound. Stage 18's re-cut named this group at 86 ids, the whole remainder of data/, and this census reads 86, so the rule needed no re-cut.

Named for the next stages (re-cut from the head census, 860 / 908):

• ui/ 419 ids in 84 files, about four stages. It has no subdirectory, so the same name-ordered rule applies. The first group near 100 runs from action-confirm-params-guard.test.ts to component-record-block-field-security.test.ts: 32 files, 97 messages / 102 ids. It holds three "other" strings: two expect messages in action-requires-confirmation-docblock.pin.test.ts (:168, :175) and one in component-props-unknown-members.pin.test.ts (:322). That stage should check whether any of them is a needle.
• api/ 201, two stages. system/ 165, two. The files directly in src/, 120, one.
• The three docblock needles (ai/build-progress.test.ts:236, :237, contracts/approval-service.test.ts:274), one stage with their docblocks.

What each id became

• 16 literals (17 ids) now state a decision in words.
• 12 literals (15 ids) get their subject back in words, where the number stood for a thing, such as "the Nothing refuses the contradictory pair "external.credentialsRef bound + a config.url naming no user" — the binding is a silent no-op at connect #9041 arm".
• 54 literals (54 ids) drop a number the title already explains.

Every cited record was read with its comments through REST. 33 answer 200. Six answer 404, and each decision was read from what landed, the landing commit and its CHANGELOG entry:

• cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 (e2798fab76, one driver vocabulary: mongo → mongodb, turso gets a config contract);
• [finding][spec] memory-driver persistence.path / persistence.key still accept unresolved ${…} placeholders — the #8336 shape one surface over, deliberately outside its connection-material class #8495 (4bfe1a539d, ${…} refused in memory persistence.path / persistence.key at publish);
• A bound external.credentialsRef is silently dropped on the DSN branches of the mysql and mongodb driver arms #8696 (90a12fb18d, a bound secret injected on the mongodb DSN branch);
• @objectstack/spec/data owns the userinfo grammar but exports only its password half — the mongo DSN arm cannot inject a bound credential without a username accessor #8876 (d634e665b0, urlUserinfoUsername, the username half of the userinfo grammar);
• mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040 (24206416a7, a credential in the mongo options passthrough refused at publish);
• Nothing refuses the contradictory pair "external.credentialsRef bound + a config.url naming no user" — the binding is a silent no-op at connect #9041 (d491625c17, bound credentialsRef with a user-less mongo config.url refused at publish).

Stated in words:

record(s)	literal (under data/)	now reads
#4410	driver/config-registry.test.ts:71	"DatasourceSchema × driver config — parsed against the contract its driver ships". Ruled enforce: data/driver/ became the one contract, and DatasourceSchema parses config against it.
#6969	driver/config-registry.test.ts:178	"… — what a boot flag may offer, derived from the one driver table". The CLI's hand-written --database-driver lists were replaced by a set derived from the shared table.
#8155	driver/driver-credential-refusal.test.ts:851	"accepts the blessed shape byte-identically: bare-username URL + bound secret, what the stored-credential remedy prescribes". Ruled shape (b): the operator moves the credential to the secret store; a URL-embedded one is told to keep a bare user@host and bind the secret.
#8336, #8495	driver/driver-placeholder-refusal.test.ts:234	"memory initialData stays UNJUDGED — the deliberate seed-data exclusion holds". The placeholder refusal excluded seed data; #8495 extended it to persistence.path / persistence.key only.
#9091	driver/pg-url-grammar.test.ts:39	"pg-url-grammar server twin — still asks the parser pg itself runs". A postgres config.url that pg cannot open is refused at publish.
#11072	driver/pg-url-grammar.test.ts:55	"pg-url-grammar browser twin — degrades to the shape-only checks, with no pg parse". Ruled option A: a browser export condition whose bundle drops the pg parse.
#16066	query-transport.test.ts:38	"§1 what the transport declares — a flattened spelling of the AST, never a second semantics". Ruled: the wire dialect is declared in spec as a 1:1 alias table; QuerySchema itself does not grow.
#4721	query.test.ts:202 (expect message)	"this parsed to order: asc before the sort node was closed". Ruled (a)+(b): SortNodeSchema strict, with direction → order as a prescription.
#2604	record-surface.test.ts:59	"deriveRecordFlowSurface — viewing a record may route, a create or edit task is always an overlay". Decision D1: view is a state and may route; create and edit are tasks and never route.
#2578	record-surface.test.ts:64	"view keeps the field-count detail surface verbatim: …". The detail surface is derived from the field count: heavy → page, light → drawer.
#4254	search-fields.test.ts:120	"the ingress gate that refuses an unsearchable $searchFields entry no longer admits $searchFields=id". Ruled: an unknown or unsearchable searchFields entry answers 400, never a wider scan.
#6674	search-fields.test.ts:257	"a virtual field declared in searchableFields — not admitted, since no driver stores it". Promoted on the #4254 precedent: a declared entry that can never match is not admitted.
#7572	secret-mask.test.ts:40	"SECRET_MASK — the credential read mask (ADR-0100), declared once for every masked read". Option A: one declaration in spec, re-exported by objectql and aliased by service-settings.
#8323	unique-scope-message.test.ts:137	"… the accept/reject line does not move, and bare true keeps its meaning". Ruled: no unannounced reinterpretation of bare unique: true.
#3696	unique-scope.test.ts:19	"UniqueScope (ADR-0120) — bare true on a field is unique per organization; global uniqueness must be said". Field-level true became a composite per-organization index, and 'global' the explicit opt-in.
#3184	validation.test.ts:1120	"ValidationRule - events property — insert and update only; a delete guard is a beforeDelete hook". Decision: trim delete from the enum, not enforce it.

Subject back in words (12 literals, 15 ids). In driver/driver-credential-refusal.test.ts and driver/driver-placeholder-refusal.test.ts, numbers that named a sibling refusal now name it: "#9041" becomes "the user-less URL arm" or "the user-less URL refusal", "#9147's arm" becomes "the no-username arm", "#9040" becomes "the options-passthrough credential refusal" or "the passthrough read path", "#8082" becomes "the URL userinfo refusal" or "check", "the inverted #8078 pin" becomes "the pin that once recorded them as accepted, inverted", "#8336" in "the deep judgement" becomes "the deep placeholder judgement", and "the honest #4410 boundary" becomes "the honest boundary of config validation".

Dropped where already stated (54 literals, 54 ids). A number goes only where the title already says its decision. Examples: "QueryAST.joins — REMOVED (#4286)" and its three siblings; "FieldNode — the nested-select object form is REMOVED (#4196)"; "AggregationNode.distinct — REMOVED (#6815, ADR-0049)", which keeps (ADR-0049); the four #13879 — describe prefixes, each of which states its semantics; "$driver — inline credential refusal (#7990)" and the other refusal-family describes; "TursoConfigSchema refuses what the turso driver refuses (#19977)". (ADR-0049), (ADR-0100) and (ADR-0120) stay: they cite decision records by number, not tracker ids.

Readers

• Test-name filters: none. No tracked script, workflow or config passes -t / --testNamePattern.
• Snapshots: none. No __snapshots__ directory is tracked under packages/spec, and none of the 18 files calls a snapshot matcher.
• Projects: none of the 18 files is listed in packages/spec/vitest.repo-tests.json; all 18 run in the local project.
• By substring: every old literal, plus a window around each id (245 needles), was searched across the tracked tree outside its own file. No gate, doc, filter, snapshot or scripts/check-*.mjs self-test reads one. The 11 hits are:
  • 7 code comments citing "the REST 读路径：searchFields / groupBy / aggregations 指向不存在的字段时被静默降级（#4226 收口后剩下的三条轴） #4254 ingress gate" (lint validate-searchable-fields.ts / .test.ts, validate-react-page-props.test.ts, metadata-protocol protocol.search-title-namefield.test.ts, spec data/search-fields.ts:198);
  • two release-owned CHANGELOG lines;
  • a sibling title in this card's ui/ stage (ui/dashboard.test.ts:717);
  • a sibling title in metadata-protocol (protocol.query-transport-dialect.test.ts:176).
    None reads a spec test title.
• The files by name: outside CHANGELOGs, data/query.test.ts is named by test-typecheck-debt.json, which keys on the file and on error signatures, not on a title, and by two code comments; data/secret-mask.test.ts by one code comment.

Text-only proof

Stage 10's scratch tool (textonly10.cjs, md5 d5e4801dbb4329ab1984da91e92fc47c) compares base and head file by file on three legs:

1. Skeleton: the full AST, with string pieces masked. It must be identical.
2. Comments: every comment, byte-equal.
3. Strings: each changed string leaf must sit in a test-call title position or on a declared line, must carry a tracker id before, and must carry no # plus digits after. This stage declares one line, query.test.ts:202.

• Result: 18 of 18 files SAME on all three legs, with the per-file counts predicted in writing before the run.
• Totals: 82 changed string leaves in 82 literals: 81 titles and 1 declared. The diff's + and - lines are exactly the 82 planned lines, and every file keeps its line count.
• Controls (10 of 10 as predicted, on scratch copies, each anchor hit once): identifier rename DIFF; numeric literal DIFF; comment edit COMMENT DIFF; a non-title string given an id VIOLATION; a rewritten title given a new id VIOLATION; a title that was id-free at base edited VIOLATION; one title reverted to base SAME; an it.each row given an id VIOLATION; an undeclared expect message changed VIOLATION; a title re-split into a + chain DIFF.
• .each titles: five describe.each titles lose only their trailing id. No $driver / $name placeholder, row or table value changes.

Test counts: the 18 files were run at the base, in a separate base worktree, and at the head, with --project local --project repo. Both sides read 737 tests, all passed, with the same count and status sequence per file in 18 of 18. 476 full test names change, and each equals the base name with the planned replacements applied (0 mismatches). No full name repeats on either side.

Changeset: skip-changeset

Measured, not assumed:

• npm pack --dry-run of @objectstack/spec lists 2068 files. 0 of the 18 touched files are in it, and no *.test.ts at all. The controls src/data/query.zod.ts and dist/index.mjs are in it.
• In the built dist/, a new phrase and an old literal each read in 0 files. The control Unrecognized key reads in 42.

So this PR publishes nothing, and no changeset is added.

Verification (at 8788de7a4a)

• pnpm turbo run build over all packages: 71 / 71.
• @objectstack/spec:
  • vitest run --project local: 616 files, 18426 passed, 1 todo.
  • typecheck: exit 0, including check:test-typecheck (52 files / 246 errors / 135 pinned signatures held). Its program holds all 18 touched files, counted with tsc --listFilesOnly -p tsconfig.test.json.
  • check:generated: all 15 generated artifacts up to date.
• Gates: dispatch-gates --commands derived 79 families, the same set as stages 13 to 18, and all 79 exit 0. --ran reconciles: 79 derived, 79 run, 0 NOT-MEASURED, 0 UNRUN, every family with its exit code recorded.
  • The five roster families whose rosters sit under a touched directory were also run, and each exits 0: check:meta-url-spelling, check:spec-changes, check:authz-resolver, check:error-code-casing and check:filter-alias-parity.
  • The reconciliation printed STALE TREE: scripts/engine-double-contract.pinned.json moved on main after the base. This diff adds and changes no engine double, check:engine-double-contract exits 0 on this tree, and the queue re-runs it on the merged generation.
• ESLint, a proven narrowing: --no-inline-config over the 18 files reads 0 errors and 0 warnings. The population comes from ESLint's own config: 18 configured, 0 ignored. No file sets parserOptions.project or projectService, so no untouched file's verdict can move.
• check-governed-merges --test: NOT governed, 164 changed lines.

main since the base

Re-fetched just before this PR opened, origin/main was two commits past the base (5e0b489bca: #21871, #21873). Neither touches any of the 18 files, and neither touches packages/spec. So main was not merged. git merge-tree onto 5e0b489bca is clean. No open PR touches the 18 files.

Acceptance notes

• No needle in this group. The one "other" string is an expect message, not the expected value of an assertion over a source docblock. The three known needles are untouched.
• Same-id test titles in this card's later stages go with those stages: api/protocol.test.ts:677 ([P2] data: QueryAST declares 12 members no executor runs — the liveness ledger governs metadata types, not the request surface #4286), ui/dashboard.test.ts:717 ([#14478 stack 5/6] data/ · ui/ · ai/ · integration/: the 7 remaining duration keys carry their unit in the key name — ADR-0087 conversions with readers #15680) and ui/view-authoring-wire-split.test.ts:192 (一个被静默丢弃的排序键对外部调用方仍然是静默的:direction 该 400 还是继续被丢掉(#4674 第 4 项) #4721).
• Same-id test titles in other packages are their lanes' test-string shares. A search of describe / it / test lines outside packages/spec/src finds 49 lines citing ids this PR handled, in 12 packages: service-datasource 18 (8 files), metadata-protocol 7 (4), objectql 6 (4), cli 5 (3), lint 4 (3), driver-sql 3 (3), and one each in client, driver-turso, platform-objects, plugin-security, rest and service-settings. Examples: cli/src/commands/database-driver-flag-derivation.test.ts:63 ("--database-driver 的 oclif 白名单改为从共享驱动表推导 —— 裁定第 3 项「一个词表、一处推导」的后半(阻塞于 PR #6910) #6969 — …"), driver-sql/src/sql-driver-unique-tenancy.test.ts:48 ("(多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696)"), lint/src/validate-searchable-fields.test.ts:809 ("[A virtual formula field declared in searchableFields clears lint and the #4254 gate, then silently matches nothing — the same fail-open shape #4254 closed one axis over #6674] …").
• Code comments still carry ids in these files and their sources, for example the [#6674] and [#4483] blocks in search-fields.test.ts, the [#16066] header of query-transport.test.ts and data/search-fields.ts:198. Comments are not this card's share, and none is touched here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5e0b489bcacecf2ab6e91e20ed856ca2452d9c2e → packageMentionDocs.