fix(lint): state the measured refusal in the three write-set rule messages

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[claude]

Fixes#13858

Three lint rule messages told authors that an undeclared field write has a driver-dependent outcome — "on a SQL driver the whole call fails with a driver-level error; on a schemaless driver (memory, MongoDB) the stray key is persisted". For the paths those three rules actually judge, that has not been true since the declared-field door landed (#8682 insert, #8738 update).

The triage comment made a reproduction the hard gate: measure the three paths first, do not rewrite the prose from the call shape. That was done before a word was changed.

The measurement

Six runs — three paths, two driver families each. Real QuickJS sandbox, real hook body and real action body through hookBodyRunnerFactory / actionBodyRunnerFactory, real ObjectQL engine, the real AutomationEngine with the real builtin CRUD node executors, real @objectstack/driver-sql (better-sqlite3, real table) and real @objectstack/driver-memory.

path	driver-sql	driver-memory
hook body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
action body ctx.api.object('deal').update({ stagee })	INVALID_FIELD / 400	INVALID_FIELD / 400
flow create_record / update_recordfields map	INVALID_FIELD / 400	INVALID_FIELD / 400

Every run answered Unknown field 'stagee' on object 'deal'. Nothing was stored on either family: no row after a refused create_record, an untouched row after a refused update, and no shadow column on the schemaless family — the half of the old message the runtime no longer delivers.

Verdict: no fork. All three are refused by the declared-field door before any driver is reached, so all three messages were rewritten to the measured behaviour.

Observed envelopes, verbatim:

PATH1 (hook) SandboxError code=INVALID_FIELD status=400
innerMessage: Unknown field 'stagee' on object 'deal'
message: hook 'note_touches_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH2 (action) SandboxError code=INVALID_FIELD status=400
message: action 'touch_deal' threw: Error: Unknown field 'stagee' on object 'deal'
PATH3 (flow) run success=false
Node 'mk' failed: create_record(deal) failed: Unknown field 'stagee' on object 'deal'
Node 'up' failed: update_record(deal) failed: Unknown field 'stagee' on object 'deal'
engine envelope for the identical call: code=INVALID_FIELD status=400 field=stagee

Identical on both families in every row. The reproduction ran as a scratch measurement and is not committed — packages/runtime/** is another lane's package, and the triage fenced committed runtime changes out. The tree is clean of it; see Out of scope for the pin that is genuinely warranted there.

What changed

Message text only. Rule ids, severities, match sets and hints are unchanged, and no finding changes shape — but the rule file's own header states why the prose is governed: "a lint that misdescribes the failure it is warning about teaches the wrong debugging instinct".

Each message now names the refusal in the vocabulary the ctx.input sibling landed with one branch over (REFUSED at run time — INVALID_FIELD / 400, identically on every driver), says why the door and not a driver answers (the payload is caller-supplied), and keeps its own blast radius:

• hook — the refusal escapes the body and fails the operation that triggered the hook;
• action — the refusal escapes the body and fails the action;
• flow node — the refusal is whole, so the correctly named fields in the same payload never land either, create_record never creates the row, and the step fails the run. That last clause is why this rule still gates at error; the severity is untouched.

Each corrected sentence is pinned in a dedicated test, positively on the new wording and negatively on the retired driver-split phrasing, following the message-pinning idiom PR #14202 used in this package this week.

Beyond the three sentences, and named here rather than left silent: the three file headers asserted the same retired driver split in the prose that explains those very sentences — the flow file's header carried it as its severity justification, complete with a "measured, not inferred" claim. Leaving them would have reproduced the exact defect this card names one screen above the corrected message, so they were corrected in the same edit, from the same measurement. No behaviour rides on them.

Scope fences held

unprovisionedAnchorWriteConsequence() is untouched, as the card and the triage both require: an ADR-0015 external object's injected anchor is declared in the registered schema, so it passes the door by construction and the remote database really is what refuses it. That message was already correct. No packages/runtime/** changes are committed.

Verification

All of it run against the final commit e46c976d, on a clean tree (git status --porcelain empty). Exit codes captured before any pipe, per this repo's false-green rule.

• pnpm --filter @objectstack/lint test — 88 files / 2473 tests passed, exit 0. Re-run after the final commit, so the green is about the tree the PR actually carries.
• pnpm --filter @objectstack/lint typecheck — exit 0.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0.
• Gate family derived from the actual diff, not recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack → 33 families (29 by path + 6 by change kind, 2 shared), harvested with --commands so neither spelling nor the convention block could be dropped. All 33 green.

Two of them needed the workspace closure built first and returned exit 3 (each gate's own documented NOT MEASURED branch, never a red) until it was; after turbo run build --filter='./packages/*' --filter='./packages/*/*' both were run for real:

• check:dual-build-cjs-loads — exit 0.

• check:type-check-debt — exit 0. This is the one that matters here: --re-measure re-runs tsc per ledger entry, 27 ledger entries re-measured, 1217 raw tsc errors total, none above its recorded number, and surplus: none — every entry sits exactly at its measurement, so any new error is red. So the three edited test files were type-checked after all, with zero new errors against @objectstack/lint's frozen TEST_DEBT of 16.

  Worth stating plainly, because the package-level typecheck green does not say this: packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by tsc --listFiles (0 hits for all three edited test files). That exclusion is ledgered, not a new gap — check:type-check-coverage carries @objectstack/lint in TEST_DEBT and none of its itemised files are ones this PR touches. The ledger re-measure above is what actually covers the new test code.

check-test-completeness.mjs has no local reading by construction — it parses a test-run log CI tees into it, and its own output says so: "the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix."

Reverse verification

Direction predicted before running: the three new pins should go red against the pre-fix text, and nothing else should move.

The fix was committed first, then the three rule sources — and only the sources, never the test files — were restored to the merge base 66ecc50a9. The mutation was proved on disk (all three blob hashes differed from their HEAD blobs; the retired schemaless phrasing measurably back in each file) rather than inferred from an editor's exit code. Result:

Test Files 3 failed (3)
Tests 3 failed | 122 passed (125)
× validate-hook-body-writes › states the measured refusal … no driver split
× validate-action-body-writes › states the measured refusal … no driver split
× validate-flow-node-writes › states the measured refusal … no driver split

Exactly three failures, exactly the three new pins — and the other 122 tests in those same files stayed green, which is the half that matters: no pre-existing test was depending on the retired wording.

Restored with git checkout HEAD -- <path> (index and tree) and the restore proved, not assumed: git diff HEAD empty, git status --porcelain empty, and each file's on-disk git hash-object equal to its HEAD blob.

Out of scope

The ctx.api and flow-node paths now have no runtime pin of their own. undeclared-field-write-driver-split.integration.test.ts pins the body-written key and the caller payload, but nothing pins the two paths measured here, so the sentences this PR just corrected could go stale again with every gate green — exactly the drift that file exists to prevent. Filed as #14241 rather than added, per the triage's packages/runtime/** fence; the scratch harness that produced the table above is the shape it wants.

---

Authored in session https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV (recorded in prose because a body edit normalises the footer link below).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d — the merge of head e46c976db4598ae364733f815f2ffded2da1a7d2 into base 1e130127c66242d8bca244aebcabe9f305a31aef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d && git checkout 022fe2a7c499edbe6fe0a2d98811bd7f0559b43d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1e130127c66242d8bca244aebcabe9f305a31aef e46c976db4598ae364733f815f2ffded2da1a7d2 && git checkout -B drift-repro 1e130127c66242d8bca244aebcabe9f305a31aef && git merge --no-ff e46c976db4598ae364733f815f2ffded2da1a7d2
node scripts/docs-audit/affected-docs.mjs --json 1e130127c66242d8bca244aebcabe9f305a31aef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.