platform-objects' keyed-text-bounds pin cannot reach plugin/service packages — four keyed unbounded text columns in plugin-audit and plugin-security still break MySQL schema-sync

[os-warren]

Found while landing route A's last column for #11374 (PR #12058). Filed unassigned.

What

The #11374 route-A rule is "a text-family column that a declared index keys on
must declare a maxLength, because a bound is what lets the column be a key at
all". On MySQL an unbounded keyed text column is emitted TEXT, the
ALTER TABLE ... ADD INDEX is refused with ER_BLOB_KEY_WITHOUT_LENGTH, and
the object lands registered-but-broken with its declared index silently absent.

That rule is now enforced by a pin — but the pin lives in
@objectstack/platform-objects and enumerates only the objects that package
exports. Platform objects that moved out to plugins under ADR-0029 K2 are
therefore outside it, and four of them declare keyed text columns with no bound:

Object	Column	Declaration	Keyed by
sys_activity	record_id	packages/plugins/plugin-audit/src/objects/sys-activity.object.ts:176	{ fields: ['object_name', 'record_id'] } (:262)
sys_audit_log	record_id	packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:229	{ fields: ['object_name', 'record_id'] } (:334)
sys_audience_binding_suggestion	package_id	packages/plugins/plugin-security/src/objects/sys-audience-binding-suggestion.object.ts:44	(package_id, permission_set_name, anchor)
sys_audience_binding_suggestion	permission_set_name	same file	same composite

All four are Field.text({ ... }) with no maxLength key in the declaration.

Evidence, and what is NOT claimed

Declaration-level, measured by walking every *.object.ts outside
packages/platform-objects/ and intersecting each object's indexes with its
text-family fields. Each row above was then read by hand to confirm it is a
real Field.text with no maxLength and a real index entry naming it.

The mechanism is measured live on this exact code path, on the same driver,
in PR #12058: sys_import_job.created_by, an unbounded keyed Field.text,
produced

[sql-driver] cannot create index 'idx_sys_import_job_created_by_created_at'
on "sys_import_job" — MySQL refuses a TEXT/BLOB column in a key without a key length

against live MySQL 8.0.46, with the column reading back text /
CHARACTER_MAXIMUM_LENGTH 65535 from information_schema and its declared
index absent. Declaring the bound moved it to varchar(255) and the index
appeared.

⛔ What I did not do: run these four objects through a live syncSchema.
They are not reachable from their packages' export surface — plugin-audit's
package.json declares only the . export and its root barrel does not
re-export ./objects, so a probe cannot import SysActivity at all. Whoever
picks this up should drive them through the plugin's own registration path
rather than by importing the object, and should treat the counts as unverified
until they do.

Why it matters (declared ≠ enforced)

Two separate failures, and the second is the one worth fixing:

1. Four declared indexes cannot exist on MySQL, so those objects are
   registered-but-broken there — sys_audit_log and sys_activity lose the
   (object_name, record_id) lookup that the ActivityPointer read path
   (ADR-0052 §5) assumes.
2. The pin is scoped to a package, not to the defect class. This is the
   second time that exact shape has bitten: route A's original pin was scoped to
   identity/ and that is precisely how sys_import_job.created_by in audit/
   survived the first pass. PR feat(platform-objects): declare a sourced maxLength on sys_import_job.created_by (#11374 route A, last column) #12058 widened it from identity/ to the whole
   of platform-objects (20+ objects → 45, 30+ keyed text columns → 78), but
   the package boundary is still a boundary, and objects keep moving across it
   under ADR-0029.

Direction (for triage — not prescribing a fix)

• Declare a sourced bound on each of the four, in route A's shape (every bound
  derived from a named producer, stated so it is vetoable in review). For the
  two record_id columns the obvious source is referenced-column transitivity
  from the record id they hold, exactly as feat(platform-objects): declare a sourced maxLength on sys_import_job.created_by (#11374 route A, last column) #12058 did for created_by; the
  physical id column driver-sql creates is table.string('id').primary(),
  knex's varchar(255).
• And/or lift the pin so it walks every package that ships platform objects
  rather than one package — the class-level fix, and the one that stops this
  recurring the next time an object moves.

Related: #11374 (route A), PR #11699 (13 identity columns), PR #12058 (this
card's origin), #11627 (the separate >768-character key class).

[yinlianghui-tw]

Triage: pm:queue + domain:services, type Bug — four declared indexes silently absent on MySQL is declared-≠-enforced with a measured live mechanism (#12058's ER_BLOB_KEY_WITHOUT_LENGTH reading), and the fix lands in services-owned object declarations (plugin-audit, plugin-security).

Scope for the claimant: the four sourced bounds in route-A shape (every bound derived from a named producer, stated so it is vetoable in review — #12058 is the worked precedent; referenced-column transitivity from the physical id varchar(255) for the two record_id columns). Drive verification through each plugin's own registration path, not by importing the object — the card records that the export surface cannot reach them, so treat its counts as unverified until the live syncSchema run. ⛔ The class-level pin lift (making the platform-objects pin walk every package that ships platform objects) is engine-lane surface — report on its feasibility in the PR body but do not implement it here; if the four-bound repair turns out to require it, stop and fork back.

Serial note: no expected overlap with the engine seat's driver-sql bands (#12015 @ 8600–9130, #11875 @ 13275–13900) — this card edits object declaration files, not the driver. Verify at claim time.

Size/model suggestion: S–M, opus.

---

Generated by Claude Code

[os-trump]

Claim: PM loop round 1 (services seat, takeover shift)
Session: session_01UQgPSniH1GFM9ZDeGyuGUa
Branch: claude/issue-12059-plugin-keyed-text-bounds
Worktree: objectstack-issue-12059
Domain: domain:services
File surface: packages/plugins/plugin-audit/src/objects/sys-activity.object.ts + packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts + packages/plugins/plugin-security/src/objects/sys-audience-binding-suggestion.object.ts (+ tests beside them; stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus — tier per this round's node scripts/pm/dispatch-gates.mjs --tier <the three object files>: "no path-derived mandate"; PM sets the default judgment tier, adopting triage's suggestion.
Clause-②: no — restoring declared = enforced (four declared indexes that silently cannot exist on MySQL start existing). Reasoned, not asserted: the nominal accept-set narrowing (text → bounded varchar) only affects values that exceed the sourced bound, and each bound is derived by referenced-column transitivity from a producer whose physical type already caps at that bound — so no legitimately storable value changes verdict. ⚠️ Fork condition binding on the dev: reverse-verify that premise per column (can a value longer than the proposed bound legitimately reach this column today?); if yes for any column, STOP and report — that column's bound is then a Clause-② content change and comes back for the gate, not into this PR.
Serial constraints cleared: wave siblings #12065 (platform-objects/plugin-webhooks/service-messaging bundles) and #11882 (cloud-connection/metadata/cli ledgers) — package-disjoint; #11477 patch (packages/verify) — disjoint. Engine seat's driver-sql in-flight bands (#12015 @ 8600–9130, #11875 @ 13275–13900) are driver files, not object declarations — per triage, re-verify at claim. Queue sibling #11959 also touches plugin-security — held OUT of this wave (hard serial behind this card).

---

Generated by Claude Code