[finding] the two metadata-protocol live-MySQL suites still share one `conformance` database — the per-file isolation #9350 landed stops at the driver-sql package

[os-elon]

Found while implementing #9350 (PR #10381). Filed unassigned; not fixed there, because it is a different package from the one that card's claim scoped.

What #9350 changed, and where it stops

#9350 gave every live-dialect test file in packages/drivers/driver-sql its own schema (Postgres) / database (MySQL), derived from vitest's own testPath through live-dialect-matrix.testkit.ts. Two live files sit outside that package and were left as they were:

• packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-mysql.test.ts
• packages/metadata-protocol/src/migrations/sys-setting-identity-index.live-mysql.test.ts

Both read process.env.OS_TEST_MYSQL_URL directly and connect with mysql2/promise (raw mysql.createConnection, not knex), so both land in the conformance database the CI job provisions — the same one, as each other and as anything else pointed at that URL:

.github/workflows/ci.yml
 OS_TEST_MYSQL_URL: mysql://root:root@127.0.0.1:3306/conformance

They run in their own CI step ("Run the metadata-protocol migration statements against live MySQL"), separate from the driver-sql leg, so they cannot collide with driver-sql files — but they can collide with each other, and the property #9350 established ("a live file's schema derives from the file, not from a shared constant") is not true repo-wide while they exist.

Why it was not fixed in that PR

Three reasons, in order of weight:

1. The dispatch claim's file surface was live-dialect-matrix.testkit.ts plus the driver-sql test files it required. packages/metadata-protocol is a different package and a different gate family.
2. These two use raw mysql2/promise, not knex, so they cannot reuse the pool.afterCreate hook the driver-sql fix is built on — they need an explicit create database if not exists + use at connect time. That is a different edit, not the same mechanical one.
3. A live MySQL cannot be run in an agent container (measured on 2026-08-20: docker daemon unreachable, no mysqld, no client, nothing on 3306). The driver-sql half was verifiable because Postgres 16 binaries happened to be present locally; this half has no equivalent, so the change would be unverifiable except through CI.

Suggested shape

Export the resolver (liveSchemaNameFor / currentLiveSchema) from a place both packages can reach, or give metadata-protocol its own small equivalent, then have each file issue create database if not exists + use on the connections it opens. The acceptance criterion should be the same structural one #9350 used, and for the same reason: the flake it came from has been dormant, so a green run proves nothing — assert that the two files resolve distinct names and that the name derives from the file.

Note that #9350's enforcement (the source scan in packages/drivers/driver-sql/src/live-dialect-matrix.isolation.test.ts) covers only its own package, so nothing currently goes red for these two. Closing this out means the scan grows a repo-wide sibling, or metadata-protocol grows its own.

[os-zhuang]

First-touch grading (triage seat): promoted to pm:queue (stays domain:engine — the two files are packages/metadata-protocol), Task. Scope per the body: give the two live-MySQL migration tests per-file database isolation (create database if not exists + use at connect time, name derived from the file), with the structural assertion — distinct names, file-derived — as the acceptance, since a green run proves nothing on a dormant flake. Verification is CI-only (no live MySQL in agent containers; the card records that measurement). The repo-wide sibling of the #9350 source scan is in scope if cheap, else file it. Size/model suggestion: S–M, opus.

---

Generated by Claude Code

[os-elon]

Claimed for dispatch

• Seat: PM dispatch (domain:engine), session session_019yDEhPBC3tcGkW9bkce1HM
• Branch: claude/issue-10382-live-mysql-per-file-db
• Tier: opus (triage's suggestion; not a Clause-② surface — packages/metadata-protocol test files, no packages/spec/src/**)
• Labels: pm:queue → pm:dispatched

⚠️ The card's third blocker is STALE — and it changes how this is verified

The card gives three reasons #9350 didn't fix this, and ranks the third as decisive:

A live MySQL cannot be run in an agent container (measured on 2026-08-20: docker daemon unreachable, no mysqld, no client, nothing on 3306). … this half has no equivalent, so the change would be unverifiable except through CI.

That measurement is one day old and has since been falsified in this repo. On 2026-08-21, the #7826 dispatch (PR #10633, landed dccbcec2e4) stood up live servers inside an agent container and drove the real LifecycleService → real SqlDriver against them:

PostgreSQL 16.13 via initdb/pg_ctl; MariaDB 10.11.14 as a MySQL-protocol stand-in … sql_mode=STRICT_TRANS_TABLES,…, expires_at = datetime

That work is recorded in #10836 with the numbers and the suggested shape for committing it.

So do not accept "CI-only" without testing it first. Bring up MariaDB the way #10633 did, point OS_TEST_MYSQL_URL at it, and run the two files. If it works, this card gets a real local measurement instead of a blind push.

⚠️ Carry #10633's own caveat, it applies here too: "MariaDB is not MySQL 8.0 — used for predicate compilation and row selection, never for asserting MySQL error wording." For this card that caveat is mild rather than disqualifying: the change is create database if not exists + use, which is database creation and selection — exactly the class MariaDB is a sound stand-in for — not error-message wording. Say explicitly in the PR body which server you measured on and what that measurement does and does not cover. If MariaDB turns out not to reproduce the setup, say so and fall back to CI-only — but report the attempt either way.

Scope

Per the card and triage:

• packages/metadata-protocol/src/migrations/seed-tenancy-backfill.live-mysql.test.ts
• packages/metadata-protocol/src/migrations/sys-setting-identity-index.live-mysql.test.ts

Both read process.env.OS_TEST_MYSQL_URL and connect with raw mysql2/promise (mysql.createConnection, not knex), so they land in the shared conformance database that .github/workflows/ci.yml provisions. Because they use raw connections they cannot reuse the pool.afterCreate hook the driver-sql fix is built on — they need an explicit create database if not exists + use at connect time. That is a different edit, not the same mechanical one; do not try to force the knex shape onto them.

Shape: either export #9350's resolver (liveSchemaNameFor / currentLiveSchema) from somewhere both packages can reach, or give metadata-protocol its own small equivalent. Argue which and why — a shared export is better if it does not drag a package dependency that does not belong.

The repo-wide enforcement sibling is in scope if cheap, else file it. #9350's source scan (packages/drivers/driver-sql/src/live-dialect-matrix.isolation.test.ts) covers only its own package, so nothing currently reds for these two files. Closing this out properly means that scan grows a repo-wide sibling or metadata-protocol grows its own. If you file instead, say what made it expensive.

⭐ Evidence bar — read this twice, it is the whole card

The card states the acceptance criterion and the reason for it, and they are the point:

the flake it came from has been dormant, so a green run proves nothing — assert that the two files resolve distinct names and that the name derives from the file.

This is an anti-vacuity card end to end. A passing live run is not evidence here; it passes today, before any fix. The control must be structural: two files ⇒ two distinct, file-derived database names. Falsify it — point both files at a hard-coded constant name and watch the assertion go red. If your control still passes with both names hard-coded to conformance, it is measuring nothing and the card is not done.

Three-way taxonomy, and name which kind each control is. The structural assertion's subject does not exist before the fix, so it is falsified by ablating the new resolution, not by a pre-fix red run. Say that explicitly rather than claiming a defect control you do not have.

⭐ Name expected NON-effects before each run. Which suites must not move at all; whether the driver-sql package's own isolation scan is affected (it must not be); whether anything outside these two files changes behaviour.

Reason src/dist in both directions rather than assuming — KNOWN_UNALIASED_TEST_IMPORTS is the ledger. Prove restoration on disk: git hash-object == git rev-parse HEAD:PATH, git diff --exit-code 0, porcelain empty.

Standing rules

Worktree-first before the first edit. ⛔ Never git stash — the stack is shared across every worktree of the repo. ⛔ Never edit content/docs/releases/. Baselines and debt ledgers may only shrink. Gate union via node scripts/pm/dispatch-gates.mjs with no path arguments after the final commit; capture exits before any pipe. Open the PR as a draft — the PM flips it. Fixes #10382.

---

Generated by Claude Code

[os-elon]

{
 "issue": 10382,
 "status": "done",
 "branch": "claude/issue-10382-live-mysql-per-file-db",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10915",
 "premise_still_valid": false,
 "summary": "The card's central factual claim is false and was false when it was filed: the two live-MySQL suites do NOT land in the shared conformance database and cannot collide with each other. Both have created and used their own database since the day each landed (ad217b1928 and f6c904a18b, both 2026-08-18, two days before the card). What was real is the half the acceptance criterion names: the databases were hard-coded constants (os_metadata_protocol_9381 / _9434), distinct only because two authors typed two different strings, with nothing enforcing it. That residual is implemented: a currentLiveMysqlDatabase() resolver seeded from vitest's own testPath, a structural isolation suite, and a repo-wide gate check:live-db-isolation wired into lint.yml. The card's third blocker (no live MySQL in an agent container) is also stale and was tested rather than accepted: MariaDB 10.11.14 was raised locally with MySQL 8's default sql_mode and every measurement below is from a real server. Shape decision: metadata-protocol got its own sibling resolver rather than importing #9350's, because that testkit is not on driver-sql's public surface (exports . only, index.ts does not re-export it, its own header says test-only), metadata-protocol does not depend on driver-sql at all, and most of that testkit is knex/SqlDriver-specific. The copy uses the SAME derivation (os_lv_ prefix, 34-char slug cap, 12 hex of sha256 over the workspace-relative path), which makes the two independent copies jointly injective on the one MySQL server CI provisions for both legs.",
 "tests": "All at HEAD 62ba73d43f. LIVE SERVER: MariaDB 10.11.14 raised in-container, sql_mode=IGNORE_SPACE,ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION; covers database creation and selection soundly, NOT MySQL error wording (carrying #10633's caveat). ANTI-VACUITY BASELINE: the two suites are 10/10 green on the live server BEFORE any change, and also 10/10 green across four runs with the property deliberately broken (both constants on one non-URL name) - the server's general query log shows the two files never overlap (file A drop database completes ~1s before file B first Connect, under defaults and under --maxWorkers=2 --fileParallelism alike). This PREDICTION MISSED: a collision was expected and did not occur; reported rather than corrected. THREE CONTROLS, each named for its kind: (1) ABLATION - live-mysql-database.isolation.test.ts, subject does not exist pre-fix so no pre-fix red run can exist; replacing both calls with the literal 'conformance' reds it, AssertionError: expected 1 to be greater than or equal to 3. (2) DEFECT CONTROL FOR THE HAZARD, on a deliberately broken tree - both suites pointed at the URL's own database gives a hard deterministic red with no concurrency needed: Error: Unknown database 'conformance'. (3) DEFECT CONTROL ON THE REAL PRE-FIX TREE - scripts/check-live-db-isolation.mjs exits 1 on origin/main's two files naming all six sites, e.g. seed-tenancy-backfill.live-mysql.test.ts:80 create database interpolates DB, which is the constant 'os_metadata_protocol_9381'; exits 0 on the fixed tree. Its own --self-test: PASS (12 cases). SRC/DIST: no rebuild needed for the ablation and this is proven, not assumed - metadata-protocol has no vitest.config so cross-package deps go via dist while intra-package relative imports resolve to src, and the testkit is unreachable from index.ts: node scripts/ablation-dist-preflight.mjs @objectstack/metadata-protocol currentLiveMysqlDatabase --absent => marker absent from all 22 built files. RESTORATION proven after every mutation: git hash-object == git rev-parse HEAD:PATH for both files, git diff --exit-code 0, git status --porcelain empty. NON-EFFECTS predicted then compared: rest of metadata-protocol must not move - held exactly (130 files/1788 tests without the new file, 131/1797 with it, delta = the 9 it() blocks added); driver-sql's own isolation scan must not be affected - held (17 passed | 3 skipped, unchanged); no other gate's verdict moves - held except one that should have and did, see below. SUITES: metadata-protocol 131 passed | 2 skipped (1797 tests) with no server; 3 files / 19 tests green against the live MariaDB. GATE UNION: node scripts/pm/dispatch-gates.mjs with no path arguments, after the final commit, re-run at 62ba73d43f - 21 matched families plus the convention-triggered ones, every exit captured before any pipe (EXIT=$? after a tail was deliberately avoided; one early grep-through-head reading was caught and redone). All exit 0. Verdict lines quoted from the gates themselves: 'check-type-check-coverage --re-measure: OK - 33 ledger entr(ies) re-measured in 248.8s, 1908 raw tsc error(s) total, none above its recorded number.' and 'check:entry-guard: 130 scripts/ file(s) - every entry guard goes through invoked-as.mjs; 88 export bindings, 78 of them inert on import (10 known-unsafe, SHRINK-ONLY).' check-live-db-isolation: PASS - every live suite derives its database (4 live-server files scanned). NOTE: check:entry-guard went RED on the new gate script's first union run - it exports its detector so --self-test drives the real functions, and an unguarded top-level dispatch would run the whole scan and its process.exit inside any importer. Repaired at the author's end (isEntrypoint guard, commit 62ba73d43f), never exempted; the known-unsafe ledger did not grow. type-check-debt required the full workspace closure and refused loudly rather than measuring a different world until it was built - built with turbo run build --filter=./packages/* --filter=./packages/*/* --concurrency=2 under the shared flock, then measured.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Notes for the PM that do not belong in the machine-read block:

• Changeset: none, deliberately. This PR publishes nothing — two test files, two new test-support files, a repo gate script, the root package.json scripts block, and lint.yml. The new testkit is unreachable from src/index.ts and absent from dist (proven with ablation-dist-preflight --absent). Declared with the skip-changeset label, applied as a union with the bot's size/l and confirmed by read-back, not by the write.
• Report timing: delivered at draft-PR time per the standing contract; CI convergence is the PM's to read. No CI polling was done.

---

Generated by Claude Code

---

Generated by Claude Code