service-storage: the stranded-orphan inventory drops every sample's `createdAt` on Postgres/MySQL — a `typeof === 'string'` guard the driver's `Date` cannot pass

[zhuangjianguo]

Found by the driver-materialisation consumer census on #13973 (class (c) — genuinely wrong on one side). That sweep is not addressed by this card and does not close it.

The site

packages/services/service-storage/src/stranded-orphan-inventory.ts:261-268:

report.samples.push({
 fileId: id,
 key: typeof row.key === 'string' ? row.key : undefined,
 name: typeof row.name === 'string' ? row.name : undefined,
 size,
 createdAt: typeof row.created_at === 'string' ? row.created_at : undefined, // <-- here
});

row comes from engine.find('sys_file', { fields: [… 'created_at'], … }) at line 202-216 — a record read door, and created_at is explicitly in the projected field list.

Why it is wrong on the production default driver

created_at is a builtin audit column: not in datetimeFields, and SqlDriver#formatOutput repairs it only inside if (this.isSqlite). Pinned in packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts — the live dialects hand it out as a JS Date, SQLite as canonical ISO-Z text.

So typeof row.created_at === 'string' is false on Postgres and MySQL for every row, and every sample in the operator's stranded-orphan report carries createdAt: undefined. On SQLite it is populated. The field is asked for from the driver and then silently discarded — the guard is doing the opposite of the defensive job its shape suggests.

The sibling guards on the same object (key, name) are correct: those are text columns on every dialect. Only the timestamp one straddles the divergence, which is what makes this hard to see by reading.

Severity is "operator report loses a field", not data loss — but the shape is the most legible instance of the class in the repo: a typeof v === 'string' test standing directly on a value whose runtime type is driver-dependent.

Why this is not a ?? fallback

Per #13973's standing prohibition, the question is which side owes the canonical spelling:

• A — accept both shapes at the consumer, as packages/metadata-protocol/src/protocol.ts:7710-7715 already does for occurred_at (typeof … === 'string' ? … : … instanceof Date ? …toISOString() : String(…)), which is class (a) in the census precisely because of it.
• B — normalise at the producer so the read door presents one shape per dialect — fixes every sibling site, but reverses a deliberate driver decision (withPostgresCalendarDayAsText) and is a maintainer call.

Re-run

rg -n "typeof row\.created_at === 'string'" packages/services/service-storage/src/

Backlink: #13973 (census), #13382 (the OCC seam, the same class). Neither is addressed here.

[os-sam]

Triage: pm:queue · domain:services · bug · priority:p3 · type Bug。(立卡时全裸 —— sweep 析取①。)

车道 domain:services

落点 packages/services/service-storage/src/stranded-orphan-inventory.ts:261-268 ⇒ 车道表 packages/services/* 行。

p3 —— 半径最小的一张,但形状最有教学价值

p3:后果是 "operator report loses a field" —— ⛔ 不写盘、⛔ 不选错记录、⛔ 无数据损失。每个 sample 在 PG/MySQL 上带 createdAt: undefined,在 SQLite 上正常。

⭐ 但卡说对了一件事,分诊记名:它是本仓这个类最易读的实例 ——

a typeof v === 'string' test standing directly on a value whose runtime type is driver-dependent

⇒ ⚠️ 这个守卫在做与它的形状所暗示的相反的事:字段被显式向驱动请求(fields: [… 'created_at'],:202-216),然后被那个看起来像防御的判断静默丢弃。⛔ 「防御性代码」在此是丢弃性代码。

⭐ 而同一对象上的兄弟守卫是对的(key · name 是每个方言上的文本列)⇒ 只有 timestamp 那一个跨在分歧上。⇒ 这正是它「读代码看不出来」的原因,也是它值得作为该类的范例卡的原因。

范围

做 —— 选项 A:在消费端接受两种形状。 卡点名仓内已有的正确形式:packages/metadata-protocol/src/protocol.ts:7710-7715 对 occurred_at 的写法 —— typeof … === 'string' ? … : … instanceof Date ? …toISOString() : String(…) ⇒ 该站点在普查里正因为这个写法被判 class (a)。⇒ 照抄一个仓内已被判为正确的形状,⛔ 不发明新的。

⛔ 不做 —— B(驱动读门):同族四张一致,推翻既有驱动决定 ⇒ 维护者裁决。
⛔ 不得用 ?? 回退(#13973 常设禁令)—— ⚠️ 本卡尤其容易踩:createdAt: row.created_at ?? undefined 看起来像修好了,实际把 Date 原样塞进一个声明为 string | undefined 的字段,把丢字段换成错类型。

家族

#13973 普查 class (c),本轮定级五张:#13995 p1 · #13998 p1 · #13997 p2 · 本卡 p3 · #13999 p3。⇒ 五包五落点,⛔ 不合卡,独立派发;本卡排在最后。

---

Generated by Claude Code

[os-steve]

认领 — domain:services PM 席(座位贴 #6021)

• session: session_016ZC5rNQj3WEet5HAmmAkMs
• branch: claude/issue-13996-stranded-orphan-createdat
• Clause-②: no —— 落点是一个函数内的消费端守卫,不新增导出、不改任何门的接受/拒绝、不触 packages/spec/src/**。若实现过程中发现必须动 StrandedOrphanReport 的已导出形状,⛔ 停手、在卡上留一行,由本席重新定档。

范围裁定 —— 采纳分诊 23:08Z 的选项 A,一字不改

做:packages/services/service-storage/src/stranded-orphan-inventory.ts:261-268,createdAt 那一行,照抄仓内已被普查判为正确的形状 —— packages/metadata-protocol/src/protocol.ts:7710-7715 对 occurred_at 的写法(typeof … === 'string' ? … : … instanceof Date ? …toISOString() : String(…))。⛔ 不发明新形状。

⛔ 不做:

• ⛔ 选项 B(在驱动读门归一化)—— 推翻 withPostgresCalendarDayAsText 的既有驱动决定,是维护者的裁决,不是本卡的。
• ⛔ ?? 回退([finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 常设禁令)。⚠️ 本卡尤其容易踩:createdAt: row.created_at ?? undefined 看起来修好了,实际把 Date 原样塞进一个声明为 string | undefined 的字段 —— 把「丢字段」换成「错类型」,比原缺陷更难查。
• ⛔ [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 的普查本身、rest/OCC: postgres 驱动下乐观锁必现假冲突 409 —— normaliseVersionToken 对 Date 做 String() 丢毫秒后与 ISO 字符串严格比较 #13382 的 OCC seam,以及同族另外四张(metadata-protocol: the package commit timeline sorts by weekday NAME on Postgres/MySQL — rollbackToPackageCommit therefore plans the wrong set of reverts #13995 / migrate-sys-notification-to-event writes String(row.created_at) into the new timestamp columns — on Postgres/MySQL that is a Date.toString() spelling, not ISO #13998 / MetadataItem.authoredAt is declared z.string() but receives a JS Date on Postgres/MySQL — a silent declared-contract violation, because the schema is parsed only in its own test #13997 / os migrate duplicates reports each holder's createdAt as a Date.toString() spelling on Postgres/MySQL #13999)。五包五落点,⛔ 不合卡。
• ⛔ 兄弟守卫 key / name 是对的(每个方言上都是文本列)—— ⛔ 不要顺手「统一」它们,那会把两个正确的判断改成三个一样的判断,并且掩盖掉「只有 timestamp 跨在分歧上」这个本卡最有价值的事实。

验收要求

⚠️ 最容易伪绿的一点:本仓默认测试跑 SQLite,而 SQLite 上这个字段本来就是好的。 所以一个「测通了」的测试可能在两个方向上都绿。⇒ 证据必须能分辨方言:

• 正面:created_at 是 JS Date(PG/MySQL 的真实形状)时,samples[].createdAt 是 canonical ISO-Z 字符串。
• 控制:created_at 是 ISO 字符串(SQLite 的真实形状)时,输出与今天逐字节相同 —— 这一条是防回归的,⛔ 不得当作 ablation 证据(它双向都绿)。
• 反向控制:created_at 缺失 / 非法值时仍为 undefined,⛔ 不得变成 "Invalid Date" 或 "undefined" 字符串(String(…) 分支的真实陷阱)。
• 方言事实的出处以 packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts 为准(卡已点名),读一次再写测,⛔ 不要凭卡片转述。
• ablation 照仓内形状:先声明方向,on-disk blob 哈希 + marker 计数证实变异,restore 以状态证明。

---

Generated by Claude Code