fix(driver-turso): escape the groupBy alias on the remote transport instead of gating it (#14235)

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code

[os-musk]

Fixes#14235

RemoteTransport.aggregate emits a caller-supplied output NAME in exactly two positions. #13714 routed BOTH of driver-sql's through SqlDriver.aliasIdentifierSql; #14113 moved this transport's aggregation alias to the same escaping and deliberately left the groupBy alias gated, because that position carried a landed #6401 pin asserting the refusal. This card is the recorded, non-silent reversal of that pin.

An output-column key is a NAME — quoted and escaped. A column REFERENCE is grammar — validated. So field keeps assertSafeIdentifier and outKey no longer has it:

// beforethis.assertSafeIdentifier(outKey);selectParts.push(outKey===field ? `"${field}"` : `"${field}" AS "${outKey}"`);// afterselectParts.push(outKey===field ? `"${field}"` : `"${field}" AS ${this.aliasIdentifierSql(outKey)}`,);

GroupByNodeSchema.alias is the same class of key as AggregationNodeSchema.alias; the in-memory face projects g.alias ?? g.field verbatim and the MongoDB and SQL faces agree, so this face was the last one refusing names the contract admits — 'Region Name', 'deal.stage_bucket' — with an opaque 500 out of mapDataError before #14287 and a 400 since. outKey === field still emits the alias-less "field", byte-identical.

The file surface was amended mid-round, and why

The dispatch bound this card to two files and predicted that no test outside remote-transport-groupby-node.test.ts pinned the groupBy alias refusal. That prediction was wrong, and the round stopped on it rather than widening its own scope: two more tests pinned it, each left behind by a sibling card as a hand-off addressed to this one.

• remote-transport-aggregation-alias-quoting.test.ts (drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500 #14113): "Filed separately rather than patched inline; this control records the state it was left in."
• remote-transport-unsafe-identifier-envelope.test.ts (drivers(turso): assertSafeIdentifier still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500 #14287): "the day that card lands, this is the test that has to be rewritten deliberately rather than found red by surprise."

The PM ruled option A on the card and amended the surface to include both. Each file has exactly one case rewritten, on the same input, from a refusal assertion to the quoted emission; everything else in both files is byte-identical.

⛔ What did NOT move: unsafeIdentifierError and UNSAFE_IDENTIFIER_CODE are untouched, and every other refusal position — object, the aggregation field, the groupBy FIELD, the DDL table / column / index names — still asserts INVALID_REQUEST / 400. The envelope file's describe('the accept set is UNTOUCHED …') block drives the groupBy FIELD position and is byte-identical; its header paragraph gains one sentence recording that the OUT KEY position moved here. #14287's envelope ruling is not re-decided by this PR — this card decided which POSITIONS the gate governs, not what the gate answers when it fires.

Clause-② self-reading: no

No contract move. Nothing in packages/spec changes; GroupByNodeSchema.alias already declares this key and already admits these names. What widens is the driver's accept set, toward the contract the other three faces already implement — declared = enforced, restored. #14287's landed header says of this position "it MOVES the accept set", which is that same driver-level reading, not a spec one.

Evidence — every figure below measured at ffabb9991

Package suite green.pnpm --filter @objectstack/driver-turso test — Test Files 42 passed (42) · Tests 1146 passed (1146). Both previously-red controls pass on the new truth.

Typecheck.pnpm --filter @objectstack/driver-turso typecheck exit 0, and the tests are really in the program rather than assumed to be: tsc --noEmit --listFiles names all three edited test files exactly once each.

Ablation — direction predicted in the suite header BEFORE the run. Mutation: restore the two pre-change lines at the groupBy select site. Proved on disk by grep counts on both the injected and the removed text plus git hash-object (mutated e3ee37e6d vs HEAD blob 7de7f70ff). Result: Tests 4 failed | 14 passed (18) — the two capture cases and both executing cases fail by THROWING inside the call (unsafe identifier rejected: "bucket"; DROP TABLE deal; --", "Region Name", "deal.stage_bucket"), never on a comparison, while the field-position control, the two byte-identical-emission cases, the string-form control, all five date-bucket refusals and both parity cases stay GREEN. Restore proved by the blob hash matching HEAD again plus an empty git diff HEAD; the script restores under a trap on EXIT INT TERM with an absolute path. No dist/ leg applies, and that is measured: the suite imports the mutated unit through a relative in-package specifier vitest resolves to src/, and the package's vitest.config.ts declares no alias.

Escaped, not merely emitted. The security-relevant claim is pinned against a real SQLite-backed libsql stub, not only on a captured string: an alias of bucket"; DROP TABLE deal; -- comes back as a COLUMN NAME and the table still holds all three rows.

Driver conformance ledger, before the first edit and after the last commit — identical:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Gate union. The 36 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for this changeset, re-derived after the last commit and run at ffabb9991: 34 exit 0. The other two exit 3 = NOT MEASURED by their own text, both environmental and neither a finding: check-test-completeness ("There is no local log to hand it, so the local reading for this gate is NOT MEASURED. It is not a red, and there is nothing here to fix.") and pm/check-half-states ("it is no reading at all"). Exit codes captured after redirect, never through a pipe. Plus pnpm lint over the whole repo — exit 0 — and pnpm check:error-status-conformance — exit 0, "every derivable runtime status is documented, and every documented status is reachable."

Changeset: @objectstack/driver-turso patch. Branch merged origin/main (never rebased, never force-pushed).

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 22ea82c33374c3c9ba99719c1df84f2c600b60a3 — the merge of head ffabb9991c5eefbb6020632a829dcc39725debc2 into base 9e286e248866c40d2db662f69aa0ba6e71b4b096, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 22ea82c33374c3c9ba99719c1df84f2c600b60a3 && git checkout 22ea82c33374c3c9ba99719c1df84f2c600b60a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e286e248866c40d2db662f69aa0ba6e71b4b096 ffabb9991c5eefbb6020632a829dcc39725debc2 && git checkout -B drift-repro 9e286e248866c40d2db662f69aa0ba6e71b4b096 && git merge --no-ff ffabb9991c5eefbb6020632a829dcc39725debc2
node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session_0112hMx9hjJ9BgB28X97DS68) — flipped to ready and auto-merge (squash) armed at 09:18Z on head ffabb9991.

• ACCEPT on the card: drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone #14235 (comment 5506982748); the mid-round surface amendment and the option-A ruling on the two hand-off controls: comment 5506404777.
• Pre-landing checks at flip time: every check run on ffabb9991 completed with conclusion success or skipped (33 runs, perPage: 50; Lint & Repo Gates and all Type Check jobs success); node scripts/pm/check-governed-merges.mjs --test on the PR's 5 changed paths: 0 of 5 hit the register — not governed, ordinary queue landing applies.
• Clause-② self-reading no, concurred at ACCEPT: driver accept set widened toward the declared GroupByNodeSchema.alias contract, no packages/spec change, no public-entry export change ⇒ @objectstack/driver-turso: patch is the right level. No needs:contract-review carrier on card or PR.
• Closing keyword: Fixes #14235 only; the card closes at MERGED and its pm:dispatched is stripped in the landing record.

---

Generated by Claude Code