backfillSeedTenancy reports `no-split` over a driver it never queried — its own `absent` branch is unreachable on the memory driver

[os-elon]

Found while fixing #10677 (os migrate duplicates), in the shared module that card's seam resolution lives in. Not fixed there — the blast radius is the boot path of every memory-driver app, which is a different verification surface from a CLI report.

The defect

backfillSeedTenancy (packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts) runs at boot from runtime/src/app-plugin.ts and metadata-protocol/src/plugin.ts. On the memory driver it returns status: 'no-split' — "I looked, there is no split" — having answered nothing.

Same root cause as #10677: InMemoryDriver.execute() (memory-driver.ts:300-302) logs Raw execution not supported in InMemory driver and returns null. It neither throws nor is absent, so:

1. if (!seam?.exec) return { status: 'no-driver' } does not fire — resolveSeedTenancySeam's canRun tests typeof d.execute === 'function', which a no-op execute satisfies.
2. Step 1's absent branch is unreachable. The counter-table presence probe is written as

   // 1. Is there a counter table at all? Absent on a memory engine, and on any
   // install that has never allocated an autonumber.
   try {
    await exec(buildSequencesPresenceSql(client));
   } catch {
    return { status: 'absent', ...empty };
   }

   The comment states the intent exactly — "Absent on a memory engine" — but the no-op seam returns rather than throwing, so the catch never runs and the memory engine never reaches absent.
3. Step 2 then does normalizeRows(await exec(buildSplitProbeSql(client), …)). normalizeRows(null) is [] (:351, if (!result) return [];), so splits.length === 0 and the function returns no-split.

The distinction being lost is the one #10677 turned out to be about: a seam that cannot answer is absent, not empty. null is a fourth thing next to the three dialect result-set shapes normalizeRows flattens — it means "I did not run your query", and normalizeRows maps it onto "your query returned no rows".

Severity

Lower than #10677: this is a boot-time migration whose no-op on a seamless driver is the correct action, so no data is mishandled. What is wrong is the reported status, which is the value a caller would use to tell "nothing to repair" from "could not look" — and the module's own comment shows absent was meant to be reachable here.

Suggested direction (not a ruling)

The consumer-side shape #10677 landed for the CLI applies: judge the seam by whether it returns a result set, not by whether execute exists. normalizeRows is the natural home for the distinction since it is where the conflation happens today, but making resolveSeedTenancySeam or backfillSeedTenancy return absent/no-driver for a non-answering seam changes boot behaviour for every memory-driver app and example, so it wants its own triage rather than a rider.

⛔ Note the constraint that shaped #10677: the maintainer's 2026-08-05 investment freeze covers the driver-memory/driver-mongodb family, so making InMemoryDriver.execute() throw is not available without a maintainer ruling, however much tidier it looks.

The mongodb branch is not claimed here — that driver was not loaded while measuring this.

Refs: #10677 · PR #10788

[huangyiirene]

Triage: lands in packages/metadata-protocol → domain:engine; pm:queue, type Bug. Rationale: concrete defect with an exact mechanism (a non-answering seam's null is flattened by normalizeRows into "zero rows", making the module's own documented absent branch unreachable on the memory driver) and a consumer-side fix precedent already landed for the same class (#10677 / PR #10788). Dispatch constraints for the engine seat: ⛔ the 2026-08-05 investment freeze covers driver-memory — InMemoryDriver.execute() must not be changed without a maintainer ruling; the fix belongs on the consumer side (normalizeRows / seam resolution), and since it changes boot-time reported status for every memory-driver app, the PR should pin both readings (absent on a non-answering seam, no-split on a real seam with no split rows). The mongodb branch is explicitly unmeasured — out of scope unless separately established.

---

Generated by Claude Code

[os-elon]

Claimed for dispatch

• Seat: PM dispatch (domain:engine), session session_019yDEhPBC3tcGkW9bkce1HM
• Branch: claude/issue-10789-seed-tenancy-absent-seam
• Tier: opus (not a Clause-② surface — packages/metadata-protocol, no packages/spec/src/**)
• Labels: pm:queue → pm:dispatched

Triage's constraints (issuecomment-5370147376) are carried into the brief verbatim, including the two hard fences.

⛔ Two fences, both hard

1. The 2026-08-05 investment freeze covers driver-memory / driver-mongodb ([裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499). InMemoryDriver.execute() must not be changed — not to throw, not to signal, not "just a one-line marker". However much tidier making it throw looks, that is a maintainer ruling this card does not have. The fix is consumer-side: normalizeRows / seam resolution.
2. The mongodb branch is explicitly unmeasured — that driver was not loaded when this was found. Out of scope unless you establish it yourself with a measurement, and if you do, say so and keep it separable.

The defect, and the thing to be careful about

backfillSeedTenancy returns status: 'no-split' — "I looked, there is no split" — on the memory driver, having looked at nothing. The chain, all in packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts:

• InMemoryDriver.execute() logs and returns null. It neither throws nor is absent, so canRun's typeof d.execute === 'function' is satisfied and if (!seam?.exec) return { status: 'no-driver' } never fires.
• The counter-table probe's catch → return { status: 'absent' } is therefore unreachable on the memory engine — and the code's own comment says "Absent on a memory engine", so this is provably a broken intent, not a design choice.
• normalizeRows(null) returns [], so step 2 sees zero rows and reports no-split.

⭐ The distinction being lost is the card's own sentence and it is the whole point: a seam that cannot answer is absent, not empty. null is a fourth thing beside the three dialect result-set shapes normalizeRows flattens — it means "I did not run your query", and today it is mapped onto "your query returned no rows".

Precedent to follow rather than reinvent: #10677 / PR #10788 landed exactly this consumer-side shape for the CLI — judge the seam by whether it returns a result set, not by whether execute exists. Read that diff first; if you diverge from its shape, say why.

⭐ The evidence bar — this card is about a status nobody currently reads

Triage names the acceptance directly, and it is a two-sided pin:

the PR should pin both readings — absent on a non-answering seam, and no-split on a real seam with no split rows.

The second half is what stops the fix from being vacuous. A change that returns absent whenever it is unsure would satisfy the first pin perfectly and destroy the value of the status. Both controls, or the card is not done.

Three-way taxonomy, name which kind each control is:

• The absent-on-a-non-answering-seam control is a defect control — it goes red on the pre-fix tree, because the wrong no-split is observable today. Use it; do not reach for an ablation where a real defect control exists.
• The no-split-on-a-real-seam control is a preserved-behaviour control — it passes pre-fix, so falsify it by mutating your own fix (e.g. make the non-answer detection over-trigger) and show it going red.

⚠️ This changes boot-time reported status for every memory-driver app and example. Name the blast radius concretely: which examples boot on the memory driver, what they log before and after, and whether anything downstream branches on status. If some caller treats no-split and absent alike today, say so — that is the difference between a fix and a rename.

⭐ Name expected NON-effects before each run: the SQL-driver path must not move at all; no-driver must still fire where it fires today; the mongodb branch must be untouched; no example's boot must break.

Reason src/dist in both directions rather than assuming — KNOWN_UNALIASED_TEST_IMPORTS is the ledger, ablation-dist-preflight.mjs proves dist state. Prove restoration on disk (git hash-object == git rev-parse HEAD:PATH, git diff --exit-code 0, porcelain empty).

Standing rules

Worktree-first before the first edit. ⛔ Never git stash — the stack is shared across every worktree of the repo. ⛔ Never edit content/docs/releases/. Baselines and debt ledgers may only shrink. Gate union via node scripts/pm/dispatch-gates.mjs with no path arguments after the final commit; capture exits before any pipe. Open the PR as a draft — the PM flips it. Fixes #10789.

---

Generated by Claude Code

[os-elon]

{
 "issue": 10789,
 "status": "done",
 "branch": "claude/issue-10789-seed-tenancy-absent-seam",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10964",
 "premise_still_valid": true,
 "summary": "Verified the card's premise against origin/main before writing code: InMemoryDriver.execute() still returns null (memory-driver.ts:302), resolveSeedTenancySeam's canRun still passes on it, and step 1's `absent` branch was still unreachable — the defect is real and unmoved. Fixed consumer-side in packages/metadata-protocol only; no driver package touched (#5499 freeze respected). backfillSeedTenancy's READ probes are now held to the standard that separates the cases — a driver that answers returns a RESULT SET — via a module-private isResultSet + selectRows; the throw lands in the catch each probe already had, so no new branch and no new status. Two deliberate divergences from PR #10788's shape, both argued in the PR body: no extra preflight statement (step 1's presence probe is already a SELECT every boot runs) and the wrapper is NOT applied to every exec, because this module also issues UPDATE/DELETE which return no result set on some dialects — wrapping those would have broken the repair on the very installs it exists for, and there is a test pinning it. Also corrected the no-driver/absent doc comments, both of which claimed the memory engine. BLAST RADIUS, concretely: the memory driver reaches this migration via DevPlugin's zero-install dev stack (plugin-dev/src/dev-plugin.ts:473-482), plus service-datasource's memory arm and rung-3 fallback; examples/embed-objectql names the driver but embeds ObjectQL directly and never boots the plugin that runs this. What they LOG before and after: nothing, in both cases — neither no-split nor absent emits a line, and neither writes a sys_migration receipt (that is applied-only), so a memory-driver boot is byte-identical in output. Anything downstream branching on status? NO — both boot callers await and discard the result, so today no caller distinguishes the two. Stated plainly rather than glossed: this makes a status honest for its first consumer and makes a documented branch reachable; it is a fix rather than a rename because the absent branch was dead code, not because a caller changes behaviour. DELIBERATELY NOT DONE: did not import @objectstack/driver-memory in any new test — check:driver-memory-census gates every module binding against a SHRINK-ONLY ledger whose header rules an unledgered arrival needs a disposition through #5704 Q2 / #6664 first; nothing is lost, since the execute()->null shape is already pinned on a real booted driver by the CLI's duplicates.null-seam.test.ts (#10677). Did not export isResultSet from the package index (no consumer outside the module; that index's own comment names a test-only export as the shape to catch).",
 "tests": "All commands run in worktree ../objectstack-10789 under flock /tmp/os-heavy-verify.lock, exits captured before any pipe. TWO-SIDED BAR, both halves delivered. (1) DEFECT CONTROL — `absent` on a non-answering seam, red on the PRE-FIX tree on the real code path (no ablation, per the brief): `Tests 3 failed | 1810 passed | 10 skipped (1823)`, all three `AssertionError: expected 'no-split' to be 'absent'`. Post-fix same suite `Tests 1813 passed | 10 skipped (1823)` — exactly those three flipped. (2) PRESERVED-BEHAVIOUR CONTROL — `no-split` on a real seam with no split rows; passes pre-fix, so falsified by MUTATING MY OWN FIX to over-trigger (an empty result set read as a non-answer): metadata-protocol `Tests 14 failed | 45 passed (59)`, runtime real-driver file `Tests 8 failed | 1 passed (9)` with `expected 'absent' to be 'no-split'`. Under that mutant the absent defect controls stayed GREEN — exactly the failure mode the two-sided bar exists to catch. The real-driver half runs on a real SqlDriver over better-sqlite3 and takes the load-bearing measurement from the driver rather than assuming it: buildSequencesPresenceSql (`WHERE 1 = 0`, matches nothing by construction, runs every boot) comes back a bare [] and MUST read as an ANSWER, else every healthy SQL install would boot to `absent`. SRC/DIST reasoned both directions: packages/runtime resolves @objectstack/metadata-protocol through dist per KNOWN_UNALIASED_TEST_IMPORTS, so mp was rebuilt before EVERY read and each leg proved on the artifact — fix leg `ablation-dist-preflight: marker present in 2 built files`, plus a behavioural probe importing dist/index.js printing DIST_SAYS=no-split; MUTANT leg rebuilt and proved live the same way (DIST_SAYS=absent) rather than assumed. RESTORATION proved on disk: git hash-object == git rev-parse HEAD:PATH (both d7daae02416d191ff89ddbf8476e8d5be648ce94), git diff --exit-code 0, porcelain empty, and `marker absent from all 22 built files` after the restore rebuild. NON-EFFECTS predicted before each run then compared — SQL path unmoved (all 8 pre-existing real-driver cases green; full runtime suite 2680 passed), no-driver still fires, mongodb untouched/unmeasured, no example boot broken (farm build 70 successful, 70 total), throwing seam unchanged. ONE PREDICTION MISSED, reported not quietly corrected: I predicted the mutant would redden 4 cases in the sibling seed-tenancy-backfill.test.ts; it reddened 6 ([no ledger] and [the receipt is out of the repair's own reach] also drive the applied path through a fixture whose presence probe returns []) — same mechanism, wider blast than predicted. GATE UNION via `node scripts/pm/dispatch-gates.mjs` with NO path arguments after the final commit, at 608905ce60 with porcelain empty: all 19 green (14 path-matched + 5 convention-triggered) — check:changeset-gate-self-tests, check:cross-package-test-inputs, check:durability-log-level, check:objectui-changeset, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-adr-0087-registration, check-changeset-no-major, check-ci-filter-parity, check-cross-package-test-inputs, check-empty-changeset, check-plugin-teardown-shape, check-affected-docs, check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:type-check-coverage, check:type-check-debt --re-measure. Ratchet's own verdict line on the built closure: `check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 343.0s, 1908 raw tsc error(s) total, none above its recorded number.` Also ran check:driver-memory-census (EXIT=0) though the derivation calls it unreachable — it is the gate that shaped a design decision. Suites: metadata-protocol `Tests 1813 passed | 10 skipped (1823)`; runtime `Tests 2680 passed (2680)`; runtime typecheck (`tsc --noEmit`, script echoed so it really ran) exit 0. NOTE: metadata-protocol ships NO typecheck script — a --filter for one would match zero scripts and exit 0 silently — so its type surface is covered by tsup's DTS build (`DTS Build success`) and by the ratchet, not by a filtered typecheck I could have mistaken for green.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #10965: service-package carries its own normalizeRows (src/index.ts:177) whose two consumers read a non-answering seam as a fact about the data — get() returns null (\"package not installed\") and list() returns [] (\"no packages installed\") over a driver that never ran the query. Third instance of the same class after #10677 and this card, and arguably worse: these are PRODUCT values callers act on, not a reported status. Filed unassigned, no labels (concrete defect, PM triages); I established the conflation by reading only and said so — which hosts reach it at boot, and whether anything writes on that reading, are explicitly unmeasured.",
 "not filed (pre-existing and already tracked): check:type-check-debt reports a 12-error surplus under its plugin-auth ceiling, self-described as \"not an error\" and carrying its own tracking issue #6376. Unrelated to these paths; not lowered here, since that is another card's ledger.",
 "not filed (already an acknowledged in-code deferral, not a new finding): isResultSet and quoteIdent now each exist twice, in metadata-protocol and in the CLI's migrate/duplicates.ts. The source already records unifying them as a separate decision (#9381 PR discussion). #10965 notes that a third consumer arriving would be the first real evidence it is worth doing."
 ]
}

---

Generated by Claude Code