test(metadata-protocol,objectql): key the protocol stub engines by table - #16651

Fixes #16225

Eleven protocol test harnesses gave their stub engine one flat row map and told the tables apart in exactly one place — the insert early-return for sys_metadata_audit. find / findOne ignored the table argument entirely, so every other table a save writes (sys_metadata_history, sys_metadata_commit) landed in the map that answered reads of sys_metadata.

Each stub now holds a map from table NAME to that table's rows, reached through a tableOf(name) accessor — the shape protocol.runtime-gate-stored-universe.test.ts (#16223) established, copied rather than reinvented. rows stays bound to sys_metadata, so every existing assertion reads the table it names.

Why the remaining seven were worth touching

"Had the assertion been written the other way round — or had the harness been used to prove a store-reading change works — it would have passed for a reason that exists nowhere but in the stub."

The defect was caught by the polarity of one assertion, not by anything structural. That is the whole argument: this shape does not produce a red someone investigates, it produces a green that closes a card.

The incident, reproduced and pinned

Driving one DRAFT saveMetaItem through a converted harness and dumping each table:

TABLE sys_metadata         rows=1  state="draft"
TABLE sys_metadata_history rows=1  keys=[id,event_seq,type,name,version,operation_type,metadata,
                                         checksum,previous_checksum,change_note,source,
                                         organization_id,recorded_by,recorded_at]   no `state` key
TABLE sys_metadata_audit   rows=1  keys=[id,occurred_at,actor,source,type,name,organization_id,
                                         operation,outcome,code,lock_state,lock_overridden,
                                         request_id,note]                            no `state` key

All three are addressed to the same (type, name, organization_id), and the two journal rows carry no state. A flat map hands them back to a sys_metadata read; a harness that also models sys_metadata.state's declared defaultValue: 'active' — correctly, which is what made it convincing — serves a DRAFT-only artifact back as an ACTIVE metadata row.

Two pins, one per package, assert that a sys_metadata read answers with the store row and nothing else:

• packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts
• packages/objectql/src/protocol-save-meta-repo-path.test.ts

Each is guarded by a firing control (the save must really have written the journals, or the read below measures an empty universe) and asserts on store-only columns (state, checksum) rather than on a row count. That last choice is load-bearing: a journal row is addressed to the same key keyOf builds, so under a merged map it can simply OVERWRITE the store row and a count- or name-based assertion still reads one row of the right name. The first draft of the objectql pin was vacuous for exactly that reason and was rewritten.

Ablation — one leg per package

Mutation: tableOf re-merged to hand every caller the same map. On-disk proof taken both ways (deleted text 1 -> 0, injected text present), blob hash compared against HEAD:path before and after.

The metadata-protocol leg is the sharper reading: exactly one test in that file distinguishes the two shapes, and it is the one this PR adds. The four extra reds on the objectql leg come from the audit row colliding with the store row under that file's keyOf once the audit_skip early-return is gone as well — the ablation removes the whole change, not just half of it.

Scope rule 2 — the shape population, measured

A population defined by a spelling is not a population defined by the shape, so the shape was measured directly. Both halves of the card's shape are read from each fake engine's OWN parameter name, so the expression is spelling-independent. Two references deliberately do not count as using the table argument: assertEngineFindOnePredicate(p, opts) (checks the caller's predicate, never selects a row — this is why the eight read as table-aware to a naive grep) and the sys_metadata_audit early-return itself.

Script: shape-census.mjs, run over packages/metadata-protocol packages/objectql, 93 files declaring an async insert.

Controls, both directions, from the same run: the reference fix protocol.runtime-gate-stored-universe.test.ts, protocol.package-publish-audit-rows.test.ts and sys-metadata-repository.contract.test.ts are all table-keyed and are all absent from the before-listing; all 8 files the card names are present in it. A first version of the census reported 120 files and a second reported the reference fix itself as blind — both were parser bugs (the type-literal brace in Promise object return types read as the method body), found by those controls.

Triage of the residue:

• The 9th full-shape hit is packages/objectql/src/hook-run-as.test.ts — a recording engine (insert pushes to a seen log and returns a constant; there is no row map, and its parameter is _o, an object not a table). Not this family, not converted.
• Of the 15 FLAT-WRITE files, 4 persist nothing on insert (protocol.delete-object-registry-unregister, protocol.delete-receipt-wording, protocol.driver-text-disclosure, plus hook-run-as); their rows are pre-seeded and their findOne already guards table !== 'sys_metadata'. They are the 4 that remain, and they are false positives of the axis, not residue.
• The other 3 beyond the card's 8 — protocol.container-issue-descent, protocol.invalid-metadata-422-face-inventory, protocol.save-union-issues — carry the flat map but answer null / [] from every read, so no row of one table can be served as a row of another. What the flat map still did there was make rows.size the total of every table one save writes. Same mechanical change, so converted here; the sub-shape is stated in each file's own header note.

So the spelling did not under-count the incident shape — it coincides with it at 8 — but it did under-count the flat-map family by 3.

Scope rule 1 — reds

None. All 11 harnesses were green before conversion (162 tests) and green after; the full suites of both packages are green (2433 + 4802). Nothing was passing because a sys_metadata_history row answered a sys_metadata read, which matches the card's own statement that the flaw is latent. Nothing was re-merged, nothing was relaxed, no card was filed for a red because there was none.

The audit_skip early-return is gone

With the tables separated it has no job left — audit rows land in sys_metadata_audit, which no read in these files consults. Removing it also clears the trap protocol.package-publish-audit-rows.test.ts names in its own header: a suite that later wants to assert on audit rows written in one of these files would otherwise be born vacuous. No test asserts on a row id, so the nextId shift it causes is unobservable (verified: zero matches for r_[0-9] in the eight).

Clause-② — re-derived from the diff that exists

No. The diff is 11 *.test.ts files in two packages and nothing else. Nothing exported moves, no accept set widens or narrows, no published payload gains a key, no product code is touched. needs:contract-review not hung. No product change was needed to make any converted harness honest.

Changeset: test-only, nothing publishes ⇒ skip-changeset.

Verification

• Gate derivation, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands with no hand-listed paths, reconciled with --ran:
  Run reconciliation — 48 derived, 46 run, 2 NOT-MEASURED, 0 UNRUN.
• The 2 NOT-MEASURED, in the gates' own words, both refusing on an unbuilt dependency closure and neither chaseable with a bigger heap:
  • pnpm check:dual-build-cjs-loads — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/. Run pnpm build first. ⛔ This is NOT a pass: nothing was measured."
  • pnpm check:type-check-debt — "check-type-check-coverage: PREREQUISITE NOT MET … --re-measure cannot run: 17 workspace dependencies of the ledgered packages have no built type entry point on disk." Its own report names this process's limit as 8240 MB with no OOM.
• The two live risks this diff carries are both green: pnpm check:engine-double-contract exit 0, pnpm check:test-source-alias exit 0. No gate asked for a ledger row, so no ledger was touched.
• pnpm --filter @objectstack/metadata-protocol test — 169 files, 2433 passed, 10 skipped.
• pnpm --filter @objectstack/objectql test — 284 files, 4802 passed.
• pnpm --filter @objectstack/metadata-protocol --filter @objectstack/objectql typecheck — exit 0, and tsc --noEmit --listFiles confirms the converted test files are inside the typecheck program (not excluded).
• eslint . --no-inline-config over the whole repo at 220bfdba: 6301 files, 0 errors, 0 warnings, exit 0. No narrowing claimed — this is the whole population.
• Every exit code above was captured after a redirect, never through a pipe.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

Generated by Claude Code