test(objectql): declare the recorded-by fixture's lookup with the canonical reference key

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14535

protocol-recorded-by-null.test.ts declared recorded_by as { type: 'lookup', referenceTo: 'sys_user', readonly: true } under a comment claiming it is "the real declaration". The rename is the last step of this change, not its point: the card ruled that what the file's second half has been proving had to be established first, with an instrument rather than a reading.

Step 1 — the instrument, and what it read

referenceTargetOf (packages/spec/src/data/field-value.zod.ts:141) is the single arbiter the #4441 write-path guard resolves a lookup's target through: assertReferencesResolve calls it at packages/objectql/src/engine.ts:5814 and skips the field at if (!target) continue when it answers nothing. It reads the reference key only (plus the implicit target of type: 'user').

Instrument. A temporary probe wrapped the engine's own assertReferencesResolve and referenceExists on this fixture's real protocol write path, and counted the target probe the guard performs. Control: the fourth row below — the same instrument does register a probe when a target resolves, so an empty count is a real absence rather than a blind instrument.

Reading, over the fixture's own writes (saveMetaItem with an actor and without one):

declaration under test	guard entered	isSystem	target probe
referenceTo + readonly: true (as written)	yes, twice	false	none
reference + readonly: true (after the rename)	yes, twice	false	none
referenceTo, readonly removed	yes, twice	false	none
reference, readonly removed	yes, twice	false	referenceExists('sys_user', 'usr_alice')

and directly: referenceTargetOf answers undefined for the referenceTo spelling and 'sys_user' for reference.

So the guard did run here — this is a non-system write, and recorded_by was present both in the caller-supplied payload and in the normalized data. It simply never looked at the field's target, because to the arbiter there was none. The readonly exemption the file's second half claims to exercise is not what admitted these writes; the target-less skip is. Row three is the proof: with the alias spelled, deleting the exemption changes nothing at all.

That is the triage's step 1 answered in its own terms — the exemption has been exercised against a field with no target, not against the case the file says it covers.

Steps 2 and 3 — the rename, and the assertions that had to change with it

Because the branch was never reached, this is not a rename. Two pins are added so the file proves what its header says:

1. the declaration resolves — referenceTargetOf(sysMetadataHistoryObject.fields.recorded_by) is 'sys_user'. This is the fidelity claim as an assertion instead of prose. A raw object literal handed to the registry is never parsed by FieldSchema, so the alias could never be refused where it was written ([finding] docs vs driver disagree on whether lookup columns get a real FOREIGN KEY — and the driver branch keys on reference_to, not reference #11567), and nothing in the suite could notice.
2. an actor id no sys_user row matches is still admitted — the data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 exemption, at the protocol layer where the regression was found. This is not the sys_metadata_history.recorded_by 是 lookup('sys_user') 却存哨兵字符串 'system'——声明的类型与实际存的值不是一回事 #4556 sentinel returning: 'system' was a string the platform minted for every actor-less write, which this suite still refuses; an actor the caller named is the caller's own value, and data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441 deliberately does not police a readonly lookup (the residual is reported by the isSystem 写入仍可产生悬空 lookup 引用——需要一条只报告不拦截的巡检（#4441 残留） #4551 audit instead).

The file header now records the measurement in place of the claim it could not support.

Reverse verification — the 2x2

Each cell is the whole suite re-run; mutations were applied with an anchored edit whose landing was proved by counting the injected and the removed text, restored from HEAD under a trap, and both files verified byte-identical to their HEAD blobs afterwards (git hash-object compared to git rev-parse HEAD:path).

cell	declaration	readonly exemption in engine.ts	result
1	reference (this PR)	present	7 passed — control
2	referenceTo (rename reverted)	present	pin 1 RED, pin 2 green
3	reference (this PR)	deleted	pin 2 RED
4	referenceTo	deleted	pin 2 green (only pin 1 fails, on the alias)

Cells 3 and 4 are the same engine ablation with opposite outcomes, and the only difference between them is the spelling. That is what the rename buys: the exemption becomes load-bearing for this fixture. Cell 2 is the reverse verification for pin 1.

The engine.ts mutation was a measurement only and is not part of this diff, which is one test file. The exemption's engine-layer coverage already exists and is spelled canonically — engine-lookup-referential-integrity.test.ts, "a READONLY lookup is not the caller's to answer for"; this file's protocol-layer half was the vacuous one.

Tests

All at 64f4383eb, the head of this branch. Heavy runs went through scripts/pm/os-verify-lock.sh; exit codes captured after a redirect, never through a pipe.

• pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-recorded-by-null.test.ts — exit 0, Test Files 1 passed (1) / Tests 7 passed (7).
• pnpm --filter @objectstack/objectql typecheck — exit 0, including check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json; 44 file(s) / 242 error(s) / 69 pinned signature(s) held (the exact per-file ratchet: the new test file adds none).
• pnpm lint (whole repo, eslint . --no-inline-config) — exit 0, no output. Not narrowed.
• pnpm check:nul-bytes — OK (scanned 7986 text file(s) ... no raw ASCII control bytes). pnpm check:error-status-conformance — exit 0.
• The gate family re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (identical to the dispatch seed): 25 of 28 green, quoted in the report comment on the card.
• Three answered exit 3, PREREQUISITE NOT MET — not measured, and not a finding: check-test-completeness.mjs ("running the family locally, record this gate as NOT MEASURED" — it grades a saved turbo run test log CI tees), check:dual-build-cjs-loads and check:type-check-debt (both need the whole built closure — "Run pnpm build first. This is NOT a pass: nothing was measured"). All three measure the built world, which a test-only diff does not move; CI runs them after the closure build.
• node scripts/check-changeset-no-major.mjs — exit 0. skip-changeset: the diff is one test file, publishes nothing, and check:published-files is green with tests excluded from every whitelist.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 87ad30c103bb4e8c5d7b8a399634b59716f3c21f → packageMentionDocs.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:12Z and armed auto-merge (squash) at 16:12:28Z on head 64f4383eb.

• Review: ACCEPT on the card, comment 5512386686. Clause-② no, self-read from the diff.
• Governed-surface test on the one changed path: 0 of 1 governed — ordinary queue landing. skip-changeset, test-only.
• Enqueue bar: every check run on 64f4383eb completed green or skipped (40 runs read at 16:12Z, perPage: 50). Last standing was Test Core (1/6), 15:49:47Z to 16:09:07Z — 19 minutes, the long shard again; Lint & Repo Gates finished 16:05Z.
• The auto-merge echo reads method: MERGE — the known shape whatever was passed; the queue build ref is the reading.
• Landing owed by the seat at MERGED: verify by content on origin/main that recorded_by spells reference: 'sys_user' and that both new pins are present, strip pm:dispatched from protocol-recorded-by-null.test.ts declares recorded_by with the rejected alias referenceTo under a comment claiming it is "the real declaration" #14535, landing record on the card.

---

Generated by Claude Code