reader program 3/4 — `@objectstack/cli`: the four config-load boundaries and the gates that key off `config.objects`

[hotlong]

Part of #14122 · blocks #14512 · Blocked-by: #15004 (the acceptance probe).

Reader half of the program ruled on #14512 (comment 5528589044, maintainer 2026-09-03, batch #23). The artifact stays additive through this card.

The sites

From the boundary measurement in 5523741937. Note this package holds four independent config-load boundaries, not one — a fold at any single point reaches none of the others.

Boundary / reader	file:line	Note
B2 os serve / os dev config-module load	packages/cli/src/commands/serve.ts:2170 (bundleRequire) → :2172 (let config = mod.default || mod;)	The from-source entry. The compiled artifact never passes through it
configHasMetadata + new AppPlugin(config)	serve.ts:2802, :2923	Everything AppPlugin then reads — see card 2/4
i18n auto-registration	serve.ts:2976-2995
ObjectQL engine auto-registration	serve.ts:2632 — if (config.objects && !hasObjectQL)	⚠️ Silent: with no top-level objects this reads undefined and the engine is simply not registered
Storage-driver auto-registration	serve.ts:2669 — if (!hasDriver && config.objects)	⚠️ Same mechanism, same silence
appSecurityPluginOptions(config)	serve.ts:3710	Feeds the ADR-0056 D7 permission surface from the from-source side — the same surface card 2/4 feeds from the artifact side
B3 os build config-module load	packages/cli/src/commands/compile.ts:211 (loadConfig)	Then normalizeStackInput :231, safeParse :318, authoring rules :344, per-package run :401
B4 os migrate — its own second, independent loadConfig	packages/cli/src/utils/schema-migration-plugins.ts:1083 → configHasMetadata :1094, new AppPlugin(config, …) :1100	Not behind B2; missed by both earlier enumerations
dev.ts readArtifactObjects()	packages/cli/src/commands/dev.ts:653-666	Opens the artifact with its own JSON.parse(readFileSync(...)) at :655 and its own envelope unwrap at :656, reading top-level meta.objects at :657 to diff the inventory across recompiles. Non-fatal — it just goes permanently empty — but it is a sixth place the artifact is opened
resolveDevDatabase / os start / os db clean	dev.ts:56, start.ts:557, db/clean.ts:46	These call into resolve-project-database (card 2/4) before any stack exists

The trap in this card

The two auto-registration gates at serve.ts:2632 and :2669 are the sharpest silent failures in the whole program, and they interact with a runtime-side detail: standalone-stack.ts:785 omits the objects key entirely when the array is absent rather than setting [], and mergeBootConfig (packages/cli/src/utils/merge-boot-config.ts:42) is a plain spread. So an option-B artifact reaches these gates with config.objects === undefined and the app boots with no query engine and no storage driver, having thrown nothing. Verify this pair against card 2/4's behaviour on the probe before calling either done.

Acceptance

• The option-B leg of reader program 1/4 — the option-B acceptance probe: a two-package fixture booted through every entry path with the flattened collections absent #15004's probe goes green for every cli-side subsystem above, driven from both entry paths (compiled artifact and from source); the additive leg stays green.
• Package order comes from resolveArtifactPackageOrder (@objectstack/core, since fix(metadata): register a packages[] artifact per package at the metadata door so every object has one owner across every door (#14599) #14643) — not re-derived here.
• ⛔ Do not change composeStacks, packages/spec/src/stack.zod.ts, or what any command emits. Artifact stays additive.
• ⛔ Do not weaken or edit the probe pin to make this card pass.
• ⚠️ Whether B2/B3/B4 can be collapsed into one shared CLI config-load helper was not established — serve.ts calls bundleRequire directly while compile.ts and schema-migration-plugins.ts call loadConfig. If they turn out to be behaviourally interchangeable, one helper is better than three call sites; measure before assuming, and do not let that refactor grow this card.

Sibling cards: #15004 (probe, blocks this), #15005 @objectstack/runtime, 4/4 @objectstack/plugin-security. Emitter half: #14512.

[hotlong]

⚠️ 范围补记：探针（#15004）没有覆盖本卡的四处读取，实施时不要误以为它们有 pin 兜底

PM 席（epic #14122，session session_01UHvF5hyiZjnCyExFnfQB8m）。#15004 已交付为 PR #15039，实施席主动申明了一处覆盖边界，我把它前移到这张卡上，因为它正好落在本卡的范围内——如果只读 #15004 的验收文字，会以为「探针覆盖全部五个边界」，从而在这张卡上少测四处。

探针今天覆盖不到的四处，全部属于本卡

读取	file:line	为什么探针够不着
config.objects 门 → ObjectQL 引擎自动注册，from-source 腿	serve.ts:2632	oclif 命令体内的内联表达式，没有可调用的接缝
config.objects 门 → 存储驱动自动注册，from-source 腿	serve.ts:2669	同上
readArtifactObjects()	dev.ts:653-666	同上
union authoring-rule run	compile.ts:344	同上

⚠️ 这两个 serve.ts 门的产物腿是覆盖到的（经 createStandaloneStack 输出的 objects 键——那条路径存在的目的正是喂它们），from-source 腿没有。所以「探针对 serve.ts 有行」这句话是真的，但只真了一半，而丢引擎、丢驱动的静默失败在两条腿上都成立。

本卡因此多两条验收

1. 这四处各自补 pin，并在本卡内建立探针可附着的接缝——实施席给出的判断我认同：这些站点本来就归本卡，本卡为了修它们总要引入一个可调用的边界，那个边界就是 pin 该挂的地方。⛔ 不要用「在 option-B 配置上断言 config.objects 非空」来充数：那是照着被测读取的形状再写一遍，读取方修好后这种行会继续红，然后它会被删掉——探针的头注释里明确禁止这个形状。
2. 补进 OPTION_B_LOSSES 台账。探针用的是集合相等断言，不是「至少包含」：新增一处被测出的丢失会让 pin 红，直到台账登记它。所以本卡新覆盖的每一处，要么进台账（还没修），要么修好后不进（直接绿）——两种都行，含糊不行。

顺带：本卡卡面那条「三个 config-load 边界能否合成一个共享 helper」的存疑仍然存疑

serve.ts 直接调 bundleRequire，compile.ts:211 与 schema-migration-plugins.ts:1083 调 loadConfig。三者是否行为等价没有量过。先量再决定，且不要让这个重构撑大本卡。

---

Generated by Claude Code

[hotlong]

Claim

Dev seat, session session_01UHvF5hyiZjnCyExFnfQB8m, branch claude/issue-15006-cli-config-load-boundaries (pushed empty as a write-path probe before the first edit).

Worktree: dedicated, off origin/main 7bc5d37e4 (which carries #15039, the acceptance pin). Re-read this card's comments before starting — the only comment present is the PM scope note 5530257178; no earlier claim with a different session id exists. The card is unassigned on arrival; per the dispatch contract the assignee field is the PM's to write, so this comment plus the branch is the claim marker.

Read in full first: this card, comment 5530257178 (the four uncovered sites + the two extra acceptance conditions), #15004 and its three comments, and #14512's 5523603341 / 5523741937 / 5528589044.

Scope as I will hold it: @objectstack/cli only. composeStacks, packages/spec/src/stack.zod.ts and what any command emits stay untouched — the artifact stays additive. I will not edit packages/runtime (card #15005 owns standalone-stack.ts), and I will not weaken the probe pin: every OPTION_B_LOSSES row I delete gets a named reason and a reverse-verification.

---

Generated by Claude Code