lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from `nextCounts`, losing the next sweep's growth baseline too (split from #8896)

[os-project-manager]

Split out of #8896 by the triage seat (2026-08-15 round): that card's other four seams land in packages/metadata-protocol (domain:metadata), while this one lands in packages/objectql — one domain per card, so the engine-core seam gets its own.

The seam (verified on origin/main @ 85f5e78, originally measured by the #8845 census @ 8664a2c)

packages/objectql/src/lifecycle/lifecycle-service.ts, in checkGovernance() (~line 803):

let rowCount: number;
try {
 rowCount = await driver.count(obj.name);
} catch {
 continue;
}
nextCounts.set(obj.name, rowCount);

When the count probe fails for any reason:

• the object is silently skipped for quota (quota-exceeded alert can never fire for it) and growth alerting this sweep;
• it is also dropped from nextCounts, so the growth baseline for the next sweep is lost — the degradation outlives the failing sweep;
• nothing is logged and the sweep report carries no "incomplete" fact, so a driver outage is indistinguishable from a quiet, healthy object.

check:durability-log-level's read-seam rule cannot see this shape (valueless-exit catch) — that blind spot is measured and deliberately not gated per the #8845 ruling, which is why the seam needs fixing on its own terms.

Suggested shape

Same vocabulary the repo already uses (and the maintainer's #8833 ruling pattern for this family): discriminate the error — treat only the benign case (e.g. isMissingTableError / unprovisioned) as "no rows", and for real failures either log at the durability level or carry an explicit incomplete/skipped fact in the sweep report so the baseline loss is visible. Severity is the lowest of the #8896 set (reduced alerting, no wrong answer handed to a caller).

Refs

• Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 — the metadata-protocol siblings of this seam (same disposition question).
• check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 — the census that found it; the ruling and the numbers live in the checker's header.
• ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 — the severity outlier of the same census (integrity bypass), filed separately.

[os-zhuang]

Claim: PM loop round 3
Session: session_01NTKPDRoynY8i3HmdSFUxFj
Branch: claude/issue-8906-check-governance-count-probe
Worktree: objectstack-issue-8906
Domain: domain:engine-core
File surface: packages/objectql/src/lifecycle/lifecycle-service.ts — checkGovernance's row-count probe catch only — plus a pin file. (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus. Restore-invariant repair, no accept-set widening ⇒ no fable floor.
Serial constraints cleared: nothing in flight in this lane; lifecycle-service.ts has no other claim. Its same-parent sibling #8895 is CLOSED and merged (PR #9006, a751f7d4f), which is what frees this card — same-parent cards are never batched, and that constraint is now spent.

Premise re-verified on origin/main (⛔ not inherited)

Located by symbol, since the card's ~line 803 is from 85f5e78:

• checkGovernance opens at :792; the bare catch { continue; } sits at :805-807, directly above nextCounts.set(obj.name, rowCount) at :808.
• The card's reading holds: a failed probe skips the object for quota and growth alerting, and drops it from nextCounts, so the next sweep's baseline is lost too — the degradation outlives the failing sweep.

⚠️ One difference from the sibling card that changes the work. #8895's seam had isMissingTableError already imported in engine.ts (4 sites). Here it is not — a grep over packages/objectql/src/lifecycle/ returns zero. The predicate is available at package level, but this seam needs a new import. ⛔ Do not read the sibling's "no new import surface" note as applying here.

Ruling — ⛔ not re-litigable

The maintainer's #8833 ruling for this family inherits with its rationale: propagate via existing discrimination — unprovisioned/benign is truthful emptiness, everything else must surface.

⭐ Two landed siblings are your reference, and they took different shapes for good reasons — read both before choosing:

• PR fix(objectql): a failed cascade-delete dependents probe surfaces instead of silently skipping the referential guard (#8895) #9006 (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895, cascadeDeleteRelations): if (isMissingTableError(error)) continue; throw error; — the straightforward form.
• PR fix(metadata-protocol): four read seams that failed no longer answer from an empty accumulator #9067 (Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896, four seams): three seams took that form; the fourth (findReferencesToMeta) had its catch deleted entirely, because its callee already discriminated and the only thing the catch could swallow was a deliberate 503.

⇒ ⛔ Uniformity is the trap. Ask what driver.count() actually throws at this seam and what, if anything, already discriminates upstream — then pick. If neither shape fits, that is a fork to report, not something to improvise around.

The open question this card must answer

The card's suggested shape offers two options for the non-benign case — "either log at the durability level or carry an explicit incomplete/skipped fact in the sweep report". ⚠️ The #8833 ruling says no new response field. So: if you conclude the sweep report genuinely needs an incomplete marker, stop and report the fork — ⛔ do not add one on your own reading, and ⛔ do not silently choose logging just because it is the cheaper half. Say which you chose and why.

Gates — a LEAD, not a spec

Take your own reading with node scripts/pm/dispatch-gates.mjs against your actual paths and report additions.

⚠️ Expect check:durability-log-level to be blind to part of this — its read-seam rule classifies a catch by the expression it returns, and a valueless-exit returns none. But ⛔ do not expect a specific number from it: on #8896 that census moved 67 → 66 for a reason orthogonal to the fix (a deleted seam left the census), which falsified my prediction there. Predict the direction and explain the delta; ⛔ do not treat either "moved" or "unchanged" as certification, and ⛔ do not "fix" the gate.

⚠️ Affected set is the dependency GRAPH, not this package. This is the correction #8896 forced on my dispatch contract: when a change alters a function's failure behaviour, its consumers are what must be run. turbo ls --affected --filter=...[origin/main] names them. A package-local green is not evidence — on #8896 it hid 10 broken tests living in a consumer package.

Draft PR, base main, first line Fixes #8906. Changeset required. Report as an issue comment with the os-dev-report marker. Push early.

---

Generated by Claude Code