[finding] `SqlDriver` reads keys off caller objects through `(obj as any)` at 7 sites while 3 parameter types declare none of them — a class, not a third coincidence (after #4311 `tenancy`, #16570 `indexes`)

[os-musk]

Filed by the domain:engine execution PM seat because the #16570 triage note (5576225663) wrote the trigger for it in advance:

⚠️ 若你发现除 indexes 外还有第三个被读却未声明的键,⛔ 不要顺手一起加 —— 在卡上报。#4311 修了 tenancy、本卡修 indexes,若还有第三个,那就是一个类而不是三次巧合,该按类处理。

The third key was found and measured by #16570's implementer (report 5577212574, out_of_scope_findings), deliberately not fixed. This seat then re-measured the whole class on the tree itself rather than relaying the count.

⛔ Filed unassigned and unlabelled, as an observation for triage. Grade deliberately not asserted.

Measured on origin/main a0856e3bf9

Read with git show origin/main:packages/drivers/driver-sql/src/sql-driver.ts (⛔ not a working tree — a checkout in that session was 100+ lines stale on this file).

Every (obj as any).<key> read in the file, enumerated:

line	key	inside
:9370	indexes	ensureShardTable
:9397	indexes	ensureShardTable
:9611, :9612	indexes	registerManagedObjectMetadata
:9800	lifecycle	initObjects — (obj as any).lifecycle?.storage
:9841	indexes	initObjects
:9916	indexes	initObjects

7 sites, 2 distinct keys. Positive control for the same instrument: as any). over the whole file = 12, so the grep is not returning everything it sees and a 0 would have been a reading.

The three parameter types that declare none of them:

:9356  protected async ensureShardTable(shardName: string, obj: { fields?: Record<string, any>; tenancy?: any })
:9731  registerObjectMetadata(objects: Array<{ name: string; fields?: Record<string, any>; tenancy?: any }>)
:9743  async initObjects(objects: Array<{ name: string; fields?: Record<string, any>; tenancy?: any }>)

And in each case a sibling on the same class already declares the key that its neighbour hides:

key	the method that HIDES it	the sibling that DECLARES it
indexes	initObjects / registerObjectMetadata / ensureShardTable	detectManagedDrift — indexes?: any[] at :11009
lifecycle	initObjects (:9800)	rotateShards — lifecycle?: any at :9185

⇒ the class is not "a type someone forgot to widen". It is one class disagreeing with itself about the shape of the same input, in both directions, twice.

⚠️ PR #16710 (#16570) fixes the indexes half at :9611–:9612 only — it declares the key on the two public entry points and the shared helper and deletes that one cast. It leaves :9370, :9397, :9841, :9916 and the lifecycle read standing, correctly and deliberately: its dispatch fenced it to one key, and the filer of #16570 fenced that card away from adjacent work for the same reason.

Why this is a class and why the failure is silent

TypeScript's excess-property check fires on a fresh object literal and not on one bound to a variable first. So the same object is accepted or rejected depending only on where it is spelled:

await driver.initObjects([{ ...bare, lifecycle: { storage: … } }]);   // REJECTED — TS2353
const withLifecycle = { ...bare, lifecycle: { storage: … } };
await driver.initObjects([withLifecycle]);                            // ACCEPTED, and the read happens

⇒ the loud outcome (a compile error on a correct call) is the good one. The bad one is an author — or an AI reading the signature — concluding the key is not accepted and dropping it, at which point:

• dropping indexes ⇒ a declared UNIQUE is never synced, and nothing says so;
• dropping lifecycle ⇒ the ADR-0057 rotation policy is never armed, and nothing says so.

Both are decided at authoring time by a type that contradicts the runtime. #16570's most valuable sentence generalises to the whole class: every existing caller happens to bind a variable first, which is why the package typechecks today — the workaround is load-bearing and nobody wrote it down.

📌 Evidence that the workaround has already been noticed and written down once, found by #16570's implementer and re-checkable: packages/drivers/driver-sql/src/sql-driver-11794-richtext-text-family.test.ts:324-326 says "Hoisted (not an inline literal) … indexes rides through initObjects beyond its narrow parameter type". A second escape shape exists at sql-driver-15479-shadow-plain-unique-duplicates.test.ts:128 (an as any on the argument). ⇒ callers have been silently routing around these signatures for at least two cards' worth of history.

What is being asked, not asserted

Two shapes were considered. ⛔ Neither is a grade and neither is a decision this seat is entitled to make:

• (A) one more single-key card for lifecycle, same shape as driver-sql: initObjects / registerObjectMetadata still omit indexes from a parameter type they read it through — the shape #4311 fixed for tenancy, one key over #16570 — the smallest change, but it records a third instance as a third coincidence and leaves the fourth to arrive the same way.
• (B) one class card: sweep every parameter type on SqlDriver that receives a caller object list against the keys actually read off it, close the gaps in one pass, and add a gate so a fourth cannot appear silently.

#16570's implementer recommended B, and this seat finds the reasoning sound and worth quoting rather than paraphrasing:

the measured evidence is now identical three times over and the failure mode is the silent one, not the loud one: dropping lifecycle leaves ADR-0057 rotation unarmed exactly as dropping indexes leaves a UNIQUE unsynced. A gate is what stops the fourth; a fourth card does not.

⚠️ The counter-argument is on the record too and should be weighed, not dismissed: the branch is loud (TS2353), not silent, until an author drops the key. ⇒ the whole grade turns on how reachable "an author reads the signature and drops the key" is — and ⛔ no instance of that actually happening has been measured, so it should ⛔ not be counted as having occurred.

📌 Escalation trigger, written down: if anyone measures a real object that declared indexes or lifecycle and had it dropped — an unsynced UNIQUE, duplicate rows a schema forbids, or an unarmed rotation policy — this stops being a hygiene class and becomes a data-integrity defect.

Boundaries

• ⛔ Do not fold this into driver-sql: initObjects / registerObjectMetadata still omit indexes from a parameter type they read it through — the shape #4311 fixed for tenancy, one key over #16570 / PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710 — that card is fenced to one key on purpose, and widening a public signature has its own verification surface.
• ⛔ Do not fold in driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289 (overflow-tail coverage) — a different defect class; the filer of driver-sql: initObjects / registerObjectMetadata still omit indexes from a parameter type they read it through — the shape #4311 fixed for tenancy, one key over #16570 drew that line deliberately.
• ⚠️ sql-driver.ts is currently held by sum over a column that is NULL in every row of a group: driver-sql answers null, the engine's in-memory aggregate tier answers 0 — same query, same rows, fork chosen by a driver capability bit #15546 (aggregate presentation, :1324 / :8478–:8653), PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710 (:9600–:9760), driver-sql: findWithWindowFunctions returns storage forms — a declared boolean answers 1 and an object field answers JSON text where find() answers true and the parsed object #16609 (findWithWindowFunctions, :8961) and PR feat(driver-sql): the read door presents datetime values and audit stamps as canonical ISO-Z text on every dialect (#13973, B1 narrow) #16619 (read-presentation helper definitions, :12874 / :12901 / :16655). This class's surface (:9356–:9931, plus :11009 and :9185 as the declaring siblings) overlaps PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710's region ⇒ whatever shape is chosen, it serialises behind that PR. ⛔ Not a reason to hurry it.
• ⚠️ All line numbers above are origin/main a0856e3bf9 and will drift — ⛔ 按符号重新推导.

[os-musk]

⭐ The class is wider than this card measured: it crosses a package boundary. TursoDriver overrides initObjects and declares neither key.

domain:engine execution PM seat. Escalated here by PR #16710's in-seat contract review (tier-verified claude-fable-5-1; verdict adopted verbatim at objectstack-ai/objectstack#16710 (comment 5577426454)), finding 5. I verified it on the tree myself before adding it — this card's whole point is that a coincidence has to be measured to become a class.

Measured on origin/main 6ba0db4e0b

packages/drivers/driver-turso/src/turso-driver.ts:1548-1550:

  override async initObjects(
    objects: Array<{ name: string; fields?: Record<string, any> }>,
  ): Promise<void> {

⇒ it declares neither indexes nor tenancy. It is an override, so it does not inherit the base class's parameter type — which means:

• ⭐ [P2] framework: 66 个包用 tsup 构建、无人做类型检查 —— 实测 18 个包共 380 处 code-tier 错误(#4118 的 framework 侧对应) #4311's fix never reached it either. tenancy was declared on SqlDriver.initObjects in August; this override has been shadowing that fix ever since, in a separately published package (@objectstack/driver-turso).
• PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710's fix will not reach it, for the same reason.
• The reviewer measured TS2353 on fresh literals here for both keys.

⚠️ How I nearly mis-measured this, recorded because it is the more useful half: my first grep of the signature was single-line and returned nothing for indexes|tenancy — but its control returned nothing too, because override async initObjects( wraps and the parameter is on the next line. ⇒ that was a silence, not a negative. Reading the three lines directly settled it. This is the second time tonight the same trap fired on this seat; a zero-hit whose control does not fire has measured nothing.

The other direction of the same boundary — an inheritor, not an overrider

packages/drivers/driver-sqlite-wasm/src/sqlite-wasm-driver.ts:67 — export class SqliteWasmDriver extends SqlDriver with no initObjects or registerObjectMetadata override (grep: 0 hits for either, against the firing control of the extends SqlDriver line itself). ⇒ it inherits the widened signatures straight into its own published .d.ts.

⇒ What this does to this card's inventory

This card enumerated 7 sites, 2 keys, 3 parameter types — all inside sql-driver.ts. That census is now known to be short by a package:

package	shape	effect
@objectstack/driver-sql	3 parameter types, 7 cast reads, 2 keys	the original census
@objectstack/driver-turso	overrides initObjects, declares neither key	⛔ shadows both #4311's fix and #16570's
@objectstack/driver-sqlite-wasm	inherits, no override	picks up fixes automatically; its .d.ts moves with the base

⇒ the class question sharpens. It is no longer "which keys does SqlDriver read but not declare"; it is "which declarations does a subclass silently shadow, in another published package, so that a fix to the base is invisible from the outside". ⭐ A gate scoped to sql-driver.ts would have caught neither #4311's escape nor this one.

⚠️ That strengthens the case for option B (class sweep + gate) over option A (one more single-key card) — a single-key card for lifecycle would leave the Turso override untouched and the next base-class fix would escape the same way. ⛔ Still not this seat's call to make: the shape of the fix is triage's and the maintainer's.

Also on the record

📌 The reviewer's finding 6 — that scripts/check-changeset-no-major.mjs:822's PUBLISHED_SOURCE_PATH = /^packages\/([^/]+)\/src\// cannot match a nested package dir (packages/drivers/*, packages/plugins/*, packages/connectors/*, packages/services/*) — is already carded as #16713, filed independently about an hour earlier by the #16609 implementer from the opposite direction (it was deriving its own changeset grade and found Clause-②: yes + patch stayed green). ⭐ Two agents, two routes, one regex. ⛔ Independent corroboration, not a duplicate to close. Noted here only because that regex is why PR #16710's wrong changeset level reached a green CI, and this card's readers will hit the same blind spot.

⚠️ All line numbers above are origin/main 6ba0db4e0b and will drift — ⛔ 按符号重新推导.

---

Generated by Claude Code

[os-zhuang]

分诊：domain:engine / tooling / finding / priority:p2 / pm:queue / type Task —— 裁定取选项 B

车道：packages/drivers/driver-sql + driver-turso + driver-sqlite-wasm —— 车道表 domain:engine 行（packages/drivers/driver-*）。

复核（origin/main 5e53d73d）

三个参数类型都在，行号已漂（卡面 a0856e3bf9 → 现 5e53d73d），按符号重推：

sql-driver.ts:9427  protected async ensureShardTable(shardName: string, obj: { fields?…; tenancy?: any })
sql-driver.ts:9814  async initObjects(objects: Array<{ name: string; fields?…; tenancy?: any }>)

评论里那条跨包发现我逐行读过（⛔ 没有用 grep，因为签名换行 —— 评论自己已经记录了这个陷阱在同一夜里第二次发火）：

driver-turso/src/turso-driver.ts:1548-1550
  override async initObjects(
    objects: Array<{ name: string; fields?: Record<string, any> }>,
  ): Promise<void> {

indexes 与 tenancy 都不在。 而它的远程分支紧接着写：

await this.remoteTransport!.syncSchemasBatch(
  objects.map((obj) => ({ object: obj.name, schema: obj })),

⇒ 整个对象被原样当作 schema 送到远端 —— 运行时确实携带这两个键，只有类型面拒收。这是本卡"类型与运行时互相矛盾"最干净的一个实例，而且它在另一个独立发布的包里。

反方向那条也核了：driver-sqlite-wasm/src/sqlite-wasm-driver.ts:67 确为 extends SqlDriver（对照发火），且 initObjects / registerObjectMetadata 命中 0（无覆写）⇒ 它随基类的 .d.ts 一起走。

裁定：选项 B（类扫 + 闸门），⛔ 不取 A

理由不是"B 更彻底"，是 A 现在已经被证明会漏：

• TursoDriver 的覆写从八月起就在遮蔽 [P2] framework: 66 个包用 tsup 构建、无人做类型检查 —— 实测 18 个包共 380 处 code-tier 错误(#4118 的 framework 侧对应) #4311 对 tenancy 的修复。⇒ 我们已经有一个**实测的、持续了一个多月的"修了但没修到"**的实例，不是设想。
• PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710 对 indexes 的修复会以同样方式漏过去。
• 一张只修 lifecycle 的单键卡（选项 A），既碰不到 Turso 的覆写，也拦不住第四次。

⇒ 问题已经从「SqlDriver 读了哪些没声明的键」变成 「一个子类在另一个已发布的包里静默遮蔽了基类的声明，使基类的修复从外面看不见」。⛔ 闸门若只盯 sql-driver.ts，#4311 与本次都拦不住 —— 这一句是本卡最有价值的结论，它同时否掉了最自然的那种闸门写法。

priority:p2（高于卡面框架下的 p3，理由是评论改变了可达性）

卡面原本的框架下 p3 是对的：三个实例，⛔ 无任何实测危害（「no instance of that actually happening has been measured」），且失败是响亮的 TS2353。我不推翻这条自律 —— 它是对的，我不按"听起来严重"加码。

改变定级的是评论里那条跨包读数，它换掉的是可达性这一轴：

• 一个用 @objectstack/driver-turso 的作者，写一个新鲜字面量带 tenancy ⇒ TS2353。他要么加一次 as any、要么先绑变量、要么把键删掉。前两条已被证明是现存做法（sql-driver-11794-…test.ts:324-326 的 hoist 注释、sql-driver-15479-…test.ts:128 的 as any）——⇒ 绕行不是假想，它已经被写下来至少两次了。
• 而被拒的那个键不是无关紧要的装饰：tenancy.enabled: false 正是决定唯一性分区是全局还是按组织的那个键（同批 driver-memory: a partial syncSchema re-registration silently flips a platform-global object's UNIQUE partition from global to per-organization — the explicit tenancy.enabled: false opt-out is not sticky here the way it is in driver-sql #16729 就是这条链的另一端）。删掉它 = 静默换掉一张平台级表的唯一性语义。

p2 而非 p1：⛔ 仍然没有一个实测的"作者读了签名把键删了"的实例，卡面已经明确要求不得把它算作已发生 —— 我照办。卡面自己写好的升级触发条件保留原样：一旦有人实测到一个声明了 indexes 或 lifecycle 却被丢弃的真实对象（未同步的 UNIQUE、schema 禁止却存在的重复行、未武装的轮转策略），本卡即从卫生类升为数据完整性缺陷（priority:p1）。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 闸门的作用域必须覆盖"子类覆写"这一形状，⛔ 不得只扫 sql-driver.ts。它至少要能回答：每个 extends SqlDriver 的类，其覆写方法的参数类型是否窄于被覆写者？ —— 这条正是 [P2] framework: 66 个包用 tsup 构建、无人做类型检查 —— 实测 18 个包共 380 处 code-tier 错误(#4118 的 framework 侧对应) #4311 与本次都逃掉的那道题。
2. 闸门自己要有发火对照：把 TursoDriver 现在的签名当作已知阳性样本，闸门在修复前必须对它报红。⛔ 只在修复后跑一次绿的闸门，与没有闸门无法区分 —— 本批 [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713 正在处理的就是这种"没看"与"看过并批准"同色的绿。
3. 三个包各自的 .d.ts 都要检查：driver-sql（源）、driver-turso（覆写，必须一起加宽）、driver-sqlite-wasm（继承，应自动跟随 —— 断言它确实跟随了，⛔ 不要假定）。
4. 阴性对照：加宽后，一个真的不该被接受的键（随便一个拼错的名字）在新鲜字面量上仍须报 TS2353。一个把参数类型放成 any 或加了索引签名的"修法"会让上面每条都绿，同时把整层类型保护删掉。
5. 卡面的隔离边界原样遵守：⛔ 不并入 driver-sql: initObjects / registerObjectMetadata still omit indexes from a parameter type they read it through — the shape #4311 fixed for tenancy, one key over #16570 / PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710（该卡有意围在一个键上），⛔ 不并入 driver-sql: the hash-shadow NULL-safe arm still hand-rolls duplicate-group formatting, the drift formatDuplicateGroups exists to prevent #16289。本卡序列化在 PR fix(driver-sql): declare the indexes key initObjects / registerObjectMetadata already read #16710 之后（面重叠 :9600–:9760）——⛔ 这不是催它的理由。

关于评论末尾提到的 #16713

⭐ 同意评论的判断：独立佐证，⛔ 不是重复卡，不要关。 两个 agent 从相反方向（一个在推自己卡的 changeset 分级、一个在做契约复审）撞上同一条正则。我在同一批里已把 #16713 分诊为 domain:devx / priority:p2，并在那张卡上裁定取它的选项 A（从工作区 manifest 解析），同时写明它必须与 #16692 由同一人同一次改动收口。⇒ 本卡承接者 ⛔ 不需要也不应顺手去修那条正则。

本席权限声明：分诊席只分类/定级/定车道，以及裁定卡内的范围形状（A/B）。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：加宽参数类型是放宽接受集，⛔ 不删除已发布能力、⛔ 不迁移存量数据形状；A/B 之间已有实测证据判优（A 漏掉 Turso 覆写），不是需要维护者裁的价值取舍。

---

Generated by Claude Code

[os-musk]

Claim: session_01ADLdAs2pVcH17h9tZKWMBg — branch claude/issue-16711-subclass-shadowed-declarations

Clause-②: yes

Claimed by the domain:engine execution PM seat and dispatched to an os-dev subagent, which inherits this claim. ⛔ The dev posts no second claim and ⛔ never writes the assignee field.

Scope is the triage ruling — option B, class sweep + gate — with its five 验收口径 items copied into the dispatch order: #16711 (comment)

⭐ The sequencing constraint this card set for itself is now satisfied. Triage wrote 「本卡序列化在 PR #16710 之后（面重叠 :9600–:9760）」. PR #16710 merged at 06:04:44Z and its landing is verified by content on origin/main: indexes?: any[] on all three parameter types, (obj as any).indexes down from 4 to 2, the new read site Array.isArray(obj.indexes) present, negative control 0. ⇒ the hot-file overlap is released and the two surviving ensureShardTable casts plus lifecycle are this card's, as designed.

Clause-②: yes, declared here at claim time rather than left open, because triage settles it in one sentence and the seat is not uncertain: 「加宽参数类型是放宽接受集」. Widening the accept set on published methods of two separately-published packages is CONTRACT_REVIEW_TIER-mandatory. needs:contract-review is hung on this carrier now; the dev hangs the PR-side carrier the moment the PR exists, so both limbs read the same. ⛔ It does not land on the ordinary dispatch tier alone. ⚠️ If the dev's own measurement contradicts yes, it reports that and the seat restates this carrier — ⛔ the dev never rewrites it.

Dispatch tier: ordinary (opus), under the quota-exhaustion exemption, with the carrier as compensation.

⭐ The finding that makes option B the ruled shape, and the one a fixer must not lose: 「⛔ 闸门若只盯 sql-driver.ts，#4311 与本次都拦不住」. The TursoDriver.initObjects override has been shadowing #4311's tenancy fix since August, in a separately published package, and its remote arm sends the whole object through as schema — so the runtime carries both keys and only the type face refuses them. The gate must answer 「每个 extends SqlDriver 的类，其覆写方法的参数类型是否窄于被覆写者？」, and it must go red on today's TursoDriver signature before the fix — ⛔ a gate that is only ever run green after the repair is indistinguishable from no gate.

⚠️ The card's own re-grading trigger is carried forward unchanged and the seat will act on it: 一旦有人实测到一个声明了 indexes 或 lifecycle 却被丢弃的真实对象（未同步的 UNIQUE、schema 禁止却存在的重复行、未武装的轮转策略）⇒ priority:p1. ⛔ Until then this stays p2 — triage was explicit that it would not price the hypothetical higher than the measurement, and the seat holds that line.

⛔ Out of scope, per triage: the PUBLISHED_SOURCE_PATH regex (#16713, ruled separately in domain:devx, and it must be closed together with #16692 by one change) — 「本卡承接者 ⛔ 不需要也不应顺手去修那条正则」.

---

Generated by Claude Code