The `primaryKeyReader` three-signal union in service-datasource has no `isPrimary` producer left once the driver lands — collapse it to the spec spelling

[os-zhuang]

Blocked-by: #10676

Filed by the domain:engine execution seat (session_01RfyXxZ2WPjcjhuXpiQQc3y) as the consumer-side follow-up its own PR creates. Recording only — ⛔ no domain:* label; this lands in packages/services/service-datasource, which is not this seat's lane, and routing is triage's. The services seat asked for exactly this rather than an edit from the driver change.

What changes under it

PR #11124 (#10676 + #10998) aligns SqlDriver.introspectSchema() to the packages/spec introspection contract: columns carry primaryKey, and the retired isPrimary spelling is removed rather than emitted alongside.

ExternalDatasourceService's primaryKeyReader currently reads a three-signal union — col.primaryKey OR col.isPrimary OR table.primaryKeys.includes(col.name) — shipped by PR #11001 as a deliberate transitional belt while the two contracts disagreed. The maintainer ruling that ordered the driver alignment (2026-08-22, live session, 「同意所有」 item 9) permitted that belt for one release.

Once #11124 merges, the isPrimary arm has no in-tree producer. The belt is not broken — it keeps working precisely because it reads through a local cast ((col as { isPrimary?: unknown }).isPrimary) rather than through the interface, which is why removing the member does not touch it. That is good engineering and it is also what makes this easy to forget: nothing goes red, nothing complains, and a dead arm quietly becomes permanent.

Why the driver PR deliberately did not do it

The engine seat's dispatch authorised exactly one narrow cross-lane touch — updating external-introspection-seam.test.ts's producer-spelling assertion, which was built to redden on this flip — and ⛔ explicitly withheld authorisation to collapse the union read. Collapsing it is a judgement about how long the belt should outlive its producer, on a clock this lane does not own. The services seat's handoff note on #10676 says the same in the other direction: "Ping the services seat rather than editing it, or say so on this card and I will carve it." This card is that.

What the taker should check, not assume

• The isPrimary arm is the only dead one. table.primaryKeys remains a live, independent signal — the driver still emits it and it is the composite-key carrier (driver-sql: SQLite introspection reports only the FIRST column of a composite primary key (pk === 1 vs SQLite's 1,2,3… numbering) #10997). ⛔ Do not collapse the union to col.primaryKey alone without establishing what primaryKeys is doing for callers.
• external-introspection-seam.test.ts currently pins BOTH arms on purpose. Its updated comment says so: the union "no longer has an in-tree producer needing its isPrimary arm; collapsing it is this lane's call to make." Whichever way that call goes, that file is where it gets recorded.
• Out-of-tree producers. In-tree there are none after fix(driver-sql): introspectSchema() emits the spec introspection contract — primaryKey, dialect, introspectedAt (#10676, #10998) #11124; whether any external driver implementation emits the old spelling is unmeasured here.
• The defaultValue / indexes divergences the driver kept deliberately (unknown rather than string; indexes omitted rather than emitted empty) are not part of this — they are documented divergences, not drift.

Provenance

• External object-draft drops the introspected primary key (isPrimary vs primaryKey seam) #10676 / driver-sql: introspectSchema() returns only { tables } — the spec IntrospectedSchema contract's dialect and (required) introspectedAt are never emitted #10998 — the driver alignment (this card's Blocked-by: fires when they close).
• PR fix(driver-sql): introspectSchema() emits the spec introspection contract — primaryKey, dialect, introspectedAt (#10676, #10998) #11124 — the change that empties the arm.
• PR fix(service-datasource): read the introspected primary key at the isPrimary/primaryKey seam #11001 — shipped the belt, with its own reasoning for a union rather than a precedence chain.
• External object-draft renders a field key that is not authorable: fields.<f>.primaryKey fails tsc against ServiceObject and ObjectSchema.safeParse #11000 — unrelated despite the shared word, and still unruled: fields.<f>.primaryKey authorability in a rendered object definition is a different key in a different place.

[os-zhuang]

⛔ Closing as a duplicate of #11123 — my error, filed without a duplicate scan

domain:engine seat, session_01RfyXxZ2WPjcjhuXpiQQc3y. #11123 was filed at 19:10:16Z; this card came after it. The dispatched dev had already recorded this as an out_of_scope_findings entry, which is exactly where the report contract puts it — and my job was to verify that entry exists, not to file my own in parallel. I filed before its report arrived and skipped the duplicate scan that would have caught it.

#11123 is the better card and is the one to keep. It covers everything here plus two things this one missed — the primaryKeyReader docblock's producer table now records a collision that is no longer live, and its #10997 note still says the composite-key truncation is unrepaired upstream when PR #11104 merged it.

The two things this card carried that #11123 does not are ported to it as a comment rather than lost: the machine-readable Blocked-by: line, and the ⛔ warning against collapsing table.primaryKeys along with the dead arm.

---

Generated by Claude Code