[objectstack-fleet]

Requested by Elon · project thread

domain:devx#3 · os-elon-musk · session_016WV4cwSsWgu5WEWLNtFrf3

Fixes #30572
Refs #30054

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:scripts/codemod-split-engine.mjs --members 现在接受「模块头被手工续写过」的 facet 模块,并且在搬移改动了接收模块 import 块时,仍能逐字节证明撤销;随后用它把 registerApp、registerDriver、registerHook 三个方法体搬进各自的 facet,并删掉登记表里对应的三行例外。
• 为什么改:refactor: give the inferred-return-type public methods on the engine.ts and protocol.ts facades explicit return types (.d.ts unchanged), so the codemod can move their bodies #30054 的 PR refactor(objectql): spell the eight ObjectQL facade methods' inferred return types and move five bodies into their facets (.d.ts byte-equal) #30571 搬了五个方法体,这三个被 codemod 拒绝(engine-registration.ts 的模块头被手改过;registerHook 的撤销证明在 import 块处失败),只能留在类上当例外。
• 风险与回滚:纯搬移,运行时行为不变;@objectstack/objectql 构建出的三个 .d.ts 在搬移前后逐字节相同。撤销证明仍是逐字节比较,没有做任何空白或 import 归一化。回滚即 revert 本 PR。
• 先看:scripts/codemod-split-engine.mjs 的 headerNamesOf 与 importEditsOf;packages/objectql/src/engine-hooks-and-functions.ts 的 import 块。
• 两分钟验证:node scripts/codemod-split-engine.mjs --members --verify --base origin/main,预期最后一行写 "undoing the moves does rebuild the base engine.ts and its modules byte-for-byte",exit 0;node scripts/codemod-split-engine.mjs --self-test 预期 129 cases pass。
• 需要你做的:无,席位落地。

What changes

• scripts/codemod-split-engine.mjs, fourth pass (--members), two shapes it used to refuse:
  • A header a hand edit wrote on after. engine-registration.ts's header carries a sentence written by hand after the generated one (isExternalWriteForbidden was written there by hand). headerNamesOf now reads the words after the header sentence, in the same paragraph, as a tail, and accepts the header only when moduleHeaderLines(title, names, tail) rewraps to it byte for byte. The pass rewrites the sentence it owns (the list grows) and carries the tail over unedited; the undo rewraps the same tail. A tail that does not rewrap as the pass wraps it is still refused.
  • An import edit the prune cannot take back. registerHook's parameter docblock links HookEntry, so the move adds HookEntry to the module's import type from ./engine-top-level.js. The base module already carried an unresolved {@link HookEntry.dispatchUnscopedMultiWrite} in a staying docblock; once the binding exists, that link resolves, so "prune what nothing reads" keeps it and the undo stopped one line short of the base. importEditsOf now reads the edits the move made off the base and head import blocks (bindings added, and bindings widened from type-only to value) and the undo inverts exactly those, then prunes as before. Each inverted edit is checked: a moved member's own text must read the name, and a head that dropped or narrowed a base binding fails, since no undo could restore it. The lines left are rendered as the first pass writes them, and the result is still compared with the base byte for byte.
• The three moves, written by the codemod on the latest main: registerApp and registerDriver into engine-registration.ts, registerHook into engine-hooks-and-functions.ts. The stubs, facet members, host interfaces, host factories and imports are the pass's own output. engine.ts goes from 11,309 to 11,086 lines.
• scripts/facade-delegation-registry.json: the three #30054 rows for these members are removed; check:facade-delegation-only is green with 53 named exceptions.
• .changeset/30572-objectql-registration-bodies.md: @objectstack/objectql patch, following PR refactor(objectql): spell the eight ObjectQL facade methods' inferred return types and move five bodies into their facets (.d.ts byte-equal) #30571's changeset.

Tests

The codemod's self-test (node scripts/codemod-split-engine.mjs --self-test): 129 cases in 9 batteries pass. The fourth-pass battery gains five cases, and its pinned floor goes from 18 to 23:

1. a header a hand edit wrote on after is accepted: the list grows, the hand's words follow it unedited, and the moves prove;
2. a hand tail that does not rewrap as the pass wraps it refuses;
3. one edited character in the hand's words at head fails;
4. a base docblock link that a moved body's import comes to resolve: the undo drops the binding the move added, and the moves prove byte for byte;
5. a binding the head added that only a staying docblock links, and no moved member reads, fails.

Reverse verification (one-time, run on the committed fix, restored to the HEAD blob)

• importEditsOf made to return no edits: case 4 goes red ("undoing the moves out of engine-lifecycle.ts does not rebuild its base (first difference at line 41)"), and --members registerHook on the real tree fails again at line 46 of engine-hooks-and-functions.ts, the card's refusal.
• headerNamesOf made to accept no tail: the self-test stops at "engine-lifecycle.ts: its header is not as the first pass wrote it", and --members registerApp on the real tree refuses again with the card's message.
• After each, git checkout HEAD -- scripts/codemod-split-engine.mjs and git status --porcelain empty.

Verification

Final head is the merge of origin/main a2437b56 (which edited registerApp's body in #30656) into this branch; the moves were regenerated on that main rather than text-merged.

• Before (main f4d568ba): --members registerApp / registerDriver refused with "engine-registration.ts: its header is not as the first pass wrote it" (exit 2); --members registerHook failed the undo proof at line 46 of engine-hooks-and-functions.ts (exit 1; the card recorded line 44 on an older main).
• After: node scripts/codemod-split-engine.mjs --members --verify --base a2437b560b exits 0: "3 moved method(s) (registerHook, registerApp, registerDriver); engine.ts 11309 -> 11086 lines; undoing the moves does rebuild the base engine.ts and its modules byte-for-byte once the 7 import binding(s) only moved bodies read are pruned from the base".
• Public .d.ts for @objectstack/objectql: built at base a2437b56 and at head; dist/index.d.ts, dist/core.d.ts and dist/util-B0RqjNMv.d.ts are byte-equal (sha256 4d00ae43…, a0cdd71a…, 69f1c293… on both sides). Control: RegistrationFacet.registerApp occurs 0 times in the base dist/index.js and once in the head's, so each side's build is its own.
• pnpm --filter @objectstack/objectql typecheck: exit 0 (including check:test-typecheck). pnpm --filter @objectstack/objectql test: 556 files, 11068 tests passed (lock VERDICT command-exit 0), at head 3e387e33.
• node scripts/pm/dispatch-gates.mjs --commands: 73 families derived at head 3e387e33; 72 exit 0. pnpm check:dual-build-cjs-loads is NOT MEASURED locally (exit 3, PREREQUISITE NOT MET: it reads every package's dist/, and only the @objectstack/objectql closure was built here); CI runs it in Lint & Repo Gates. --ran: 73 derived, 72 run, 1 NOT-MEASURED, 0 UNRUN. The codemod's own self-test (above) is outside the derived set and was run separately.

Acceptance notes

• The undo is no longer computed from the head alone for the import block: it reads the base's binding names to know which bindings the move added. That is the information the head cannot carry (two different bases give the same head when a staying docblock links a name a moved body imports). The comparison itself is unchanged, byte for byte, and every edit it inverts must be one a moved member's text reads.
• Sibling codemod-split-protocol: add a pass that moves a member of the landed protocol.ts facade into its facet (it refuses its own output, and the split no longer re-proves from its #29985 base) #30518 edits scripts/codemod-split-protocol.mjs and other rows of scripts/facade-delegation-registry.json; this PR does not touch that codemod. Whichever lands second merges main.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (Not touched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is CI's run.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English (the 维护者速读 block is the lane's maintainer summary).
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 19 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/events.mdx (via registerHook (symbol, a method of class HooksAndFunctionsFacet; a method of class ObjectQL))
• content/docs/plugins/development.mdx (via registerHook (symbol, a method of class HooksAndFunctionsFacet; a method of class ObjectQL))
• content/docs/protocol/kernel/error-handling.mdx (via registerApp (symbol, a method of class ObjectQL; a method of class RegistrationFacet))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via registerHook (symbol, a method of class HooksAndFunctionsFacet; a method of class ObjectQL))
• content/docs/releases/v17/17-5.mdx (via registerHook (symbol, a method of class HooksAndFunctionsFacet; a method of class ObjectQL))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 21 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json badf24dffc27773f566987e810e36896bbd34c2b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1502beaaf68dca87d0b40cc81de406b059e9c538 — the merge of head 3e387e336fdf267b29ec5e9876db6423516a0a98 into base badf24dffc27773f566987e810e36896bbd34c2b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1502beaaf68dca87d0b40cc81de406b059e9c538 && git checkout 1502beaaf68dca87d0b40cc81de406b059e9c538
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin badf24dffc27773f566987e810e36896bbd34c2b 3e387e336fdf267b29ec5e9876db6423516a0a98 && git checkout -B drift-repro badf24dffc27773f566987e810e36896bbd34c2b && git merge --no-ff 3e387e336fdf267b29ec5e9876db6423516a0a98

node scripts/docs-audit/affected-docs.mjs --json badf24dffc27773f566987e810e36896bbd34c2b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs badf24dffc27773f566987e810e36896bbd34c2b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:devx#3 · os-elon-musk · session_016WV4cz3RTQjLh7hZBLzgtZ

席位核对 · ACCEPT · 3e387e33 · 2026-11-05T23:34Z

Head-sha: 3e387e336fdf267b29ec5e9876db6423516a0a98

• Shape: 6 files, +461/−302 (763 < 3,000), all on the claim surface (the engine codemod, engine.ts, engine-registration.ts, engine-hooks-and-functions.ts, the registry, one changeset). Not governed. Fixes #30572, Refs #30054, Clause-②: no, Metadata-protocol: none at line start.
• Premise measured: both refusals the card records were reproduced on main before the change (dev report 6671852032); main moved under the dev (fix(objectql): a package registered again lists its navigation contributions once, not once more per registration #30656 edited registerApp), and the moves were regenerated on it, --members --verify --base a2437b560b exit 0.
• The card's bar ("without weakening the byte-for-byte undo proof"): met as described in the report: the header case accepts a hand-written tail only when names plus tail rewrap to the header byte for byte; the import-block case reads the edits off the base and head import blocks, requires each to be read by a moved member's own text, fails on any dropped or narrowed base binding, and inverts exactly those in the undo. The final comparison stays byte for byte, no normalisation.
• Gates: check-runs on this head read by the seat: 35 success, 13 skipped, 0 failed or pending. Dev: public .d.ts byte-equal (3 files), objectql typecheck 0, 556 files / 11,068 tests passed, dispatch-gates 72 of 73 exit 0, 1 NOT-MEASURED (whole-tree CJS build, covered by CI's build).
• Spot checks: the three engine.ts members are one-line .call(host.of(this), …) delegations to RegistrationFacet / HooksAndFunctionsFacet; the registry drops exactly the three rows registerApp, registerDriver, registerHook.
• Changeset: '@objectstack/objectql': patch (source moved inside a published package, as refactor(objectql): spell the eight ObjectQL facade methods' inferred return types and move five bodies into their facets (.d.ts byte-equal) #30571).
• Out of scope: none. refactor: give the inferred-return-type public methods on the engine.ts and protocol.ts facades explicit return types (.d.ts unchanged), so the codemod can move their bodies #30054 still waits on codemod-split-protocol: add a pass that moves a member of the landed protocol.ts facade into its facet (it refuses its own output, and the split no longer re-proves from its #29985 base) #30518's second PR.
• Landing: non-governed; flips when the maintainer's landing word for this term is on record.