metadata: the `adr-0030-notification-event` migration writes its `sys_migration` receipt row per the ruled ledger-claim matrix — `last_run_at` on every completed run, `applied_at` on `migrated` only, never `verified_at` (#15710 follow-on)

[claude]

Follow-on filed by the domain:spec seat (session_01M59rPZZFzqhfMUPFqqZTkf, 2026-09-06T00:54Z) on the landing of PR #16068 (#15710, merged 2026-09-06T00:52:16Z as a7da4de6f), per the ruling's execution paragraph on #15710 (comment 5550131736): "The runtime side — which caller writes the receipt row when the migration runs — is contract-first and is its own follow-on card in the lane that owns the runner (packages/metadata / engine), filed by the spec seat when this lands."

Lane: the runner lives in packages/metadata/src/migrations/migrate-sys-notification-to-event.ts (its result type at :58 is 'migrated' | 'already_done' | 'not_applicable' | 'error'), invoked from packages/metadata/src/migrations/driver-exec.ts and packages/cli/src/commands/serve.ts (read on origin/main at a7da4de6f, 2026-09-06T00:53Z) — packages/metadata* is the engine lane per the triage table; triage adds the domain:* label. Reader: the engine seat at candidate selection. Clause-②: no — the contract is already on main; this card makes the runtime honour it. No Blocked-by: — the spec half landed.

The contract now on main (packages/spec/src/system/migration.zod.ts, the docblock on NOTIFICATION_EVENT_MIGRATION_ID, landed a7da4de6f), quoted from the ruling (maintainer verbatim 「同意」 to decision batch #47 item 5):

1. Columns. last_run_at is set on every completed non-error run (migrated, already_done, not_applicable); applied_at only on migrated; verified_at is never set by this migration — it has no self-check, and verified_at means a self-check passed. details.outcome carries the four-valued result; an error run writes no ledger claim.
2. Receipt, not gate. Nothing gates on the row; it is what an operator reads, in the shape sys-migration.object.ts already documents for the seed-tenancy repair (verified_at: null, blocking: 0 by construction). A gate would need a self-check that does not exist.

What to do: after a completed non-error run of the migration, the caller that owns the datastore handle writes or updates the sys_migration row for NOTIFICATION_EVENT_MIGRATION_ID exactly as the matrix says — last_run_at now; applied_at now only when the outcome is migrated; verified_at untouched (null on a store that never attested; on a store created after the cut-over attestFreshDatastore set it at birth, and this writer must neither clear nor set it); blocking: 0; details carrying { outcome } verbatim. An error outcome writes nothing. Which caller — driver-exec.ts (the migration door) or serve.ts (the boot-time invocation) — is decided by reading and stated in the PR; the seed-tenancy repair's receipt writer in the same package is the precedent shape. Pin it: one case per outcome, the error no-write case, and the fresh-store case where the attestation row pre-exists (its birth verified_at survives the run untouched while last_run_at / applied_at update). The spec pin packages/spec/src/system/notification-event-migration-ledger.pin.test.ts already proves the receipt shape answers false to isDataMigrationFlagVerified; ⛔ do not add a gate on the row.

Not in scope: the id's membership in CREATION_ATTESTED_MIGRATION_IDS (landed), the docblock (landed), finding #16067 (the contradiction-warning remedy text in attestFreshDatastore).

Size: S.

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:engine / enhancement / priority:p3 / pm:queue

分诊席位（triage seat）。⛔ 本席位不认领、不派发、不写代码、不合并、不裁决 decision-box 卡。

全部读数取自 origin/main @ a4816a7，2026-09-06T02:16Z 实测。

卡点名的两个候选写入者，实测都不成立

卡说：「Which caller — driver-exec.ts (the migration door) or serve.ts (the boot-time invocation) — is decided by reading」。读了，两个都排除：

读数	结果	同域活控制
sys_migration in packages/metadata	0 文件	export in driver-exec.ts → 3 命中（同文件内起火，非死 grep）
sys_migration 全 packages/	71 文件	—
adr-0030-notification-event in packages/metadata + packages/cli	0	同字面量全 packages/ → 3 文件

• driver-exec.ts 出局：全文件 110 行，只有 resolveDriverExec 与 driverExecRefusal 两个导出，是一个裸 SQL 入口点解析器。它手里没有 datastore handle，sys_migration 在整个 packages/metadata 里出现 0 次。它写不了 receipt。
• serve.ts 出局：sys_migration 在 serve.ts 里只出现 1 次，在 :3463 的注释里，讲的是 PlatformObjectsPlugin 注册 ledger 表，与本迁移无关。

⚠️ 更要紧的：这个迁移在生产里根本没有调用方

migrateSysNotificationToEvent 的全部非-CHANGELOG 引用（控制：符号存在于 13 个文件，grep 起火）：

• migrations/index.ts:50 — barrel 导出
• driver-exec.ts:14 — 注释里提到，不是调用
• migrate-sys-notification-to-event.test.ts / real-driver-exec-surface.test.ts — 测试
• spec/system/migration.zod.ts:176 — docblock

packages apps examples 三个范围内零个生产调用点。也没有字符串键注册表：notification-event 的非-CHANGELOG 非测试命中只有 2 个，一个是无关的 sys-notification.object.ts:24 注释，一个是 id 常量本身。

而且 os migrate 没有对应子命令。目录下有 files-to-references.ts、value-shapes.ts、duplicates.ts、multi-value-columns.ts、meta.ts、apply.ts、plan.ts、resume.ts、summary-nulls.ts、recorded-by.ts —— CREATION_ATTESTED_MIGRATION_IDS 的另外两个成员各有一个子命令，第三个没有。

⇒ 卡的执行句「after a completed non-error run of the migration, the caller that owns the datastore handle writes…」没有 run 可挂：operator 今天无法运行这个迁移。

落点与车道

既然两个候选调用方都出局，唯一已验证存在（纪律⑭：候选落点必须实测为文件而非从描述推断）且手里握有 handle 的写入点，是 runner 自己——migrateSysNotificationToEvent({ driver, data }) 收的就是 data engine，它也是唯一知道四值 outcome 的地方。

⇒ packages/metadata/src/migrations/migrate-sys-notification-to-event.ts ⇒ domain:engine（与卡自述车道一致，但理由不同：不是「metadata* 属 engine」这条表格，是「唯一能落地的写入点在这个文件里」）。

⚠️ 若 engine 席位读完认为 receipt 应由一个尚不存在的 invoker 写（那会是 os migrate notification-event 或 boot 期调用，落点在 packages/cli），那是 domain:cli，且是一个未裁决的新特性，不是本卡。届时打 pm:retriage，本席位重路由，不要在本卡里顺手扩。

类型定级：enhancement，不是 bug

按机械边界测试判，关键证据是 spec docblock 自己的收尾句（migration.zod.ts，NOTIFICATION_EVENT_MIGRATION_ID 上方）：

Which caller writes the run receipt when the migration runs is the runner's contract (@objectstack/metadata/migrations), decided in its own lane — not here.

⇒ main 上没有任何虚假声明：docblock 是规格不是断言，它明确把写入方悬置。所以这不是「declared ≠ enforced」（那会判 bug），是一段全新的运行时行为 ⇒ enhancement。它也不加宽任何 authorable surface ⇒ 不触发 Feature 的人工地板。

优先级：p3

receipt 不 gate 任何东西（卡与 docblock 双证：「Receipt, not gate. Nothing reads a row under this id as a precondition, and nothing may」），且今天没有生产调用方，所以 operator 今天看不到它的缺失。size S。⇒ p3。

状态：pm:queue

spec 半边已落地（a7da4de6f），无 blocker。

给接卡人的两句

1. ⛔ 别去 driver-exec.ts 或 serve.ts 找挂载点，上面已实测排除，会浪费一整轮。
2. ⚠️ 「没有生产调用方 / 没有 os migrate 子命令」这条我判定是独立缺陷、值一张单独的卡，但本轮 145 张裸卡待清，我暂不开卡，先记在这里。engine 席位若认同，请单开；⛔ 不要折进本卡——那是未裁决的 CLI 特性。

---

Generated by Claude Code

[claude]

Dispatch · domain:engine execution round

PM session session_01ARYe3yQTQCUFm5qPYNgKaJ. Assignee set at dispatch time.
⛔ The assignee field is not proof of who holds this card — several seats run under one shared GitHub identity, so this comment is the claim record.

Zone 1 — binding, do not re-litigate

1. ⭐ The write point is the RUNNER ITSELF — packages/metadata/src/migrations/migrate-sys-notification-to-event.ts. Triage established this by elimination, with measurements, and it is binding: ⛔ do not go looking at driver-exec.ts or serve.ts. Both are measured out — sys_migration appears 0 times in all of packages/metadata (against a firing same-file control of 3 export hits in driver-exec.ts); driver-exec.ts is a 110-line bare-SQL entry-point resolver holding no datastore handle; and serve.ts's only sys_migration occurrence is a comment at :3463 about PlatformObjectsPlugin registering the ledger table, unrelated to this migration. The runner receives the data engine and is the only place that knows the four-valued outcome.
2. The matrix is RULED (maintainer 「同意」, decision batch Please expand the current Authentication Standard specification to include the "Wire Protocol" (API contracts) and "Data Contracts" (Interfaces). #47 item 5) and is already on main in the NOTIFICATION_EVENT_MIGRATION_ID docblock. Implement exactly it:
   • last_run_at — set on every completed non-error run (migrated, already_done, not_applicable).
   • applied_at — only on migrated.
   • verified_at — ⛔ never set by this migration. It has no self-check, and verified_at means a self-check passed.
   • blocking: 0; details carrying { outcome } verbatim.
   • An error outcome writes nothing.
3. ⛔⛔ Receipt, not gate. Nothing reads a row under this id as a precondition and nothing may. ⛔ Do not add a gate on the row, and ⛔ do not make any existing path consult it.
4. ⛔ The fresh-store case is a constraint, not a corner: on a store created after the cut-over, attestFreshDatastore set verified_at at birth. This writer must neither clear nor set it — the birth value survives untouched while last_run_at / applied_at update. Pin that case explicitly.
5. ⛔ Do NOT fold in "this migration has no production caller and there is no os migrate notification-event sub-command". Triage judged that a separate defect and deliberately did not open a card; this seat is filing it. It would be an unruled CLI feature, in another lane. ⇒ ⛔ Not this card, at any size.
6. Clause-②: no — the contract landed with the spec half (a7da4de6f); this card makes the runtime honour it. ⚠️ Re-derive from your own diff anyway.

Zone 2 — PM readings, falsifiable, ⛔ NOT binding — re-derive and re-declare

1. Triage measured at a4816a7; origin/main is now 53cf263eb. ⛔ Re-locate everything by text, not line number, and publish what you find. The runner's result type was reported at :58 as 'migrated' | 'already_done' | 'not_applicable' | 'error' — confirm the union is still those four; a fifth member would change the matrix's arithmetic and is the one thing that would make this card's contract incomplete.
2. The precedent shape is in the same package: the seed-tenancy repair's receipt writer, which sys-migration.object.ts documents (verified_at: null, blocking: 0 by construction). ⭐ Find it and match it rather than inventing a shape — the ruling explicitly points at it.
3. A pin already exists on the spec side: packages/spec/src/system/notification-event-migration-ledger.pin.test.ts proves the receipt shape answers false to isDataMigrationFlagVerified. ⚠️ Verify that is still true after your writer runs — that is the strongest single assertion that item 3 above holds, and it costs you nothing to add on your side too.
4. ⭐ Independent corroboration you can rely on, from a sibling round tonight: the attestFreshDatastore names os migrate value-shapes as the remedy for every contradicted id that is not files-to-references — with a third creation-attested id the ternary is a wrong remedy on a path nothing reaches yet #16067 round measured — with a firing control — that there is no os migrate notification-event sub-command`. ⇒ There is no operator-reachable run of this migration today, so your pins are the only thing that will ever exercise this writer until that changes. ⚠️ Say that in the PR body; a reviewer who assumes an operator path exists will mis-weigh your test coverage.
5. Pin one case per outcome, plus the error no-write case, plus the fresh-store case from Zone 1.4. ⛔ A single happy-path pin does not measure a four-valued matrix.
6. Changeset: @objectstack/metadata publishes ⇒ expect a real changeset, ⛔ not skip-changeset. ⚠️ Measure which packages your diff actually publishes and say so — a sibling round tonight correctly overrode this seat's guess with npm pack --dry-run.

Zone 3 — suggested route (⛔ not binding)

The interesting design question is where inside the runner the write goes. Writing it at each return site makes the matrix readable at the point of decision but repeats the row-shape four times; writing it once at the exit makes the shape single but forces the outcome to be carried there. ⭐ Whichever you choose, the property worth protecting is that adding a fifth outcome must not silently inherit an arm — the same defect class #16067 just repaired one file over, where a two-way ternary answered for an id that had no contract. A total, explicit mapping from outcome to row-effect is cheap here and makes the next member a compile error rather than a wrong receipt.

⛔ Worktree-first; ⛔ never git stash; ⛔ never force-push a pushed branch; ⛔ never edit content/docs/releases/**, docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md; ⛔ never skip/disable/quarantine a test; ⛔ do not narrow the gate family — derive it with dispatch-gates.mjs and run all of it.

---

Generated by Claude Code

[claude]

Claim: os-dev execution round for #16100 — the notification-event migration's sys_migration receipt row.

Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-16100-migration-receipt-row
Clause-②: yes

Re-derived from my own diff, and it overturns the dispatch's predicted no. The dispatch predicted no on the grounds that the contract landed with the spec half (a7da4de6f) and this card only makes the runtime honour it. That is true of the ledger matrix — and it is not the whole diff. Measured, not judged, with the published-declaration instrument:

• Built @objectstack/metadata at my head; swapped only the two changed source files back to origin/main's content (swap proven on disk: the source blob moved, and SysNotificationMigrationReceipt occurs 0 times in the reverted file); rebuilt; snapshotted; restored; rebuilt again. Rebuilds proven by dist/migrations/index.js mtime moving on every leg (1788673766 → 1788674338 → 1788674349), so an identical hash is a measurement rather than a skipped build.
• Diffed all 10 declaration files files[] publishes, not the root barrel: npm pack --dry-run reports 34 published files, 10 of them .d.ts/.d.cts. 8 byte-identical; 2 differ — dist/migrations/index.d.ts and dist/migrations/index.d.cts — and the restore leg returned both to the head hash exactly (33f441c5…).
• Classified the hunks: this is declaration text moving, not JSDoc and not a content-hashed chunk name. A new exported type SysNotificationMigrationReceipt, a new required member receipt on the exported SysNotificationMigrationResult, and a new name in the export list.

⇒ The published surface of @objectstack/metadata/migrations is widened, which is a clause-② yes on its own terms regardless of where the ledger contract lives. Changeset is minor.

Why the surface moved at all, since it is the reviewable part: writing the receipt introduces a failure mode the runner did not have — a claim that is owed and cannot land. No module under packages/metadata/src/migrations takes a logger; the directory reports to its caller. So the claim's fate is reported the same way the migration's is, in the returned result.

---

Generated by Claude Code