fix(cli): os migrate duplicates reports every holder's createdAt as canonical ISO-8601 UTC on every dialect (#13999)

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Fixes#13999

DuplicateHolder.createdAt is declared string | null, and the holder mapper built it with String(row.created_at). created_at is a builtin audit column — not in datetimeFields, and SqlDriver#formatOutput repairs it only inside its if (this.isSqlite) arm — and the holder probe reads through the raw-SQL seam, so no presentation runs on this path at all. The dialect therefore decided what the operator saw:

Postgres / MySQL Sun Aug 30 2026 18:19:25 GMT+0800 (China Standard Time)
SQLite 2026-08-30T10:19:25.947Z

One instant, two spellings, chosen by the dialect: the operator's local zone baked in, whole seconds instead of milliseconds, no Z, and not Date.parse-safe for anything consuming this command's JSON.

The fix, and where it deliberately does not land

Canonicalised at the mapper — a new canonicalHolderCreatedAt in packages/cli/src/commands/migrate/duplicates.ts, called from the one assignment site. The CLI is a leaf consumer with a declared string | null, so it is the side that owes the canonical spelling.

• Zero edits to packages/drivers/. Giving the driver one presented shape per dialect at the read door would repair this site for free, but it reverses a deliberate driver decision (SqlDriver.withPostgresCalendarDayAsText) and is a maintainer call on the [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973 census as a whole. The driver pin packages/drivers/driver-sql/src/sql-driver-13567-audit-stamp-materialisation.test.ts was read for this card and is neither duplicated nor edited.
• Not a tolerant fallback. Per [finding] Sweep: which consumers compare or format a value whose runtime type differs between the Date-materialising drivers and the ISO-text ones #13973's standing prohibition the question is which side owes the canonical spelling, and a ?? hedge answers it by hiding it. Nothing downstream is taught to accept a second spelling.

One correction the card could not carry

Ruling 1 cites the repo's existing correct form as packages/metadata-protocol/src/protocol.ts:7710-7715. That range has drifted since the card was authored. Resolved by deepening history and reading the file at b1b7d6088 (the tip at authoring time): the cited range is the occurredAt mapper, which today lives at packages/metadata-protocol/src/protocol.ts:8074-8079, byte-identical. That is the form followed here — the structural twin of this site, a leaf mapper turning a builtin audit timestamp into a declared string.

Two arms left exactly as they were

• A holder whose object carries no created_at column still reports createdAt: null, through the probe's real withCreatedAt: false retry.
• A Date carrying no time value keeps its verbatim rendering. toISOString()throws on one (RangeError: Invalid time value), and mysql2 hands back exactly that for a zero date. A non-instant has no canonical spelling; a defect that was a spelling in a read-only report must not become a crashed migration command. This is the one deviation from the cited form, and it follows the other precedent in the same producer file — canonicalVersionInstant guards the identical hazard with Number.isFinite and MAX_TIME_VALUE.

The p3 grade re-derived, since the fix shape rests on it

The card grades this p3 because createdAt here is reported, never compared. Re-measured on this branch: the identifier appears at exactly five lines in duplicates.ts — :132 doc comment, :133 the declaration, :325 doc comment, :346 the query's AS created_at projection, :684 the assignment — and at no comparison and no sort. The only sort on holders keys on partition then id. No wrong record is chosen and nothing is written. The grade stands.

The test distinguishes the dialects

packages/cli/src/commands/migrate/duplicates.created-at-canonical.test.ts. Every existing pin on this command drives SQLite, which is the side that was already correct — so a SQLite-only test proves nothing about the defect, and this file exists to separate the two.

• §A1 the Postgres/MySQL leg: a hand-built raw-SQL seam hands the holder probe a JS Date, which is not this file's claim to make but the fact pinned against live servers in the driver file above. No runner here hosts a Postgres or a MySQL.
• §A2 the SQLite leg: a real better-sqlite3 database, the real probes, the real collector.
• §A3 the two legs agree, and what they agree on re-parses to the instant it came from.
• §A4 non-vacuity, measuring what the removed expression really produced.
• §B the two arms above.

Both legs run with the process zone forced to Asia/Shanghai, so the canonical spelling §A1 asserts is produced while the process is demonstrably not at UTC.

Ablation — the pin really catches this defect

The implementation was committed first, then the mapper reverted to String(row.created_at) on disk (mutation confirmed by counting both the injected and the removed text: injected 1, removed 0; blob 3e42719 to 97624e5), the file re-run, then restored and proven byte-identical to the HEAD blob (git diff HEAD empty, hash back to 3e42719).

× §A1 Postgres/MySQL hand a JS `Date`; the report carries canonical ISO-Z
✓ §A2 SQLite hands canonical ISO-Z text; a real database, unchanged through the mapper
× §A3 the two dialects agree — the operator reads one document, not two
✓ §A4 non-vacuity ✓ §B1 null arm ✓ §B2 invalid-Date arm
Test Files 1 failed (1) · Tests 2 failed | 4 passed (6)

The SQLite leg staying green under the ablation is the point: it is the measured form of "a test exercising only SQLite pins the side that was already correct".

Verification

All at bb642f5486, the head of this branch.

• pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/commands/migrate/duplicates — Test Files 6 passed (6), Tests 35 passed (35), the whole duplicates family including the boot-heavy integration and null-seam suites.
• pnpm --filter @objectstack/cli exec tsc --noEmit --listFiles — exit 0, no diagnostics. --listFiles used deliberately: both edited files are proven in the tsc program (1 hit each), so this is a measurement and not a green over source nothing read.
• Gate union: all 35 families derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack were run, re-derived after the last edit and reconciled with comm in both directions — nothing derived went unrun, nothing run was underived. Exit codes captured before any pipe. 33 green; the two non-zero are both exit 3, PREREQUISITE NOT MET, which each gate's own text states is not a red and not a measurement: check-test-completeness.mjs grades a saved turbo run test log and none exists locally, and scripts/pm/check-half-states.mjs needs repo-scoped REST reads this container's egress refuses (GET /rate_limit 200 with 15000 left, GET /repos/... 403 with no rate-limit headers). Both are recorded as NOT MEASURED.
• pnpm check:type-check-debt — the ratchet ran whole rather than narrowed: 27 ledger entries re-measured in 469.0s, 1217 raw tsc errors total, none above its recorded number, surplus none.
• pnpm lint (eslint . --no-inline-config, the repo-wide scan) — run whole, exit 0, 112s. No narrowing claimed and none needed.
• pnpm check:nul-bytes — OK over 7781 text files; the edited files additionally hand-scanned for raw control bytes, none found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 4 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))
• content/docs/deployment/seed-tenancy-repair.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via os migrate duplicates (command, read off packages/cli/src/commands/migrate/duplicates.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fced68788dde20f734d16209551e92d801be9b65 — the merge of head bb642f548685350eacec4fc20d9c124b1fa2ab8c into base 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fced68788dde20f734d16209551e92d801be9b65 && git checkout fced68788dde20f734d16209551e92d801be9b65
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 bb642f548685350eacec4fc20d9c124b1fa2ab8c && git checkout -B drift-repro 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 && git merge --no-ff bb642f548685350eacec4fc20d9c124b1fa2ab8c
node scripts/docs-audit/affected-docs.mjs --json 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d3b1b79c4fac1b49e96dbd0cfe41a1cf4002d16 → pass the list as
args.docs, on the commit named under Which tree this was computed on.