[huangyiirene]

Fixes #18617

Clause-②: no

What moved

packages/runtime/src/cascade-delete-multivalue-lookup-real-driver.integration.test.ts was the only real-stack pin of the multi-value cascade-delete path — ObjectQL over a real SqlDriver through the protocol data-plane delete — and it hard-coded client: 'better-sqlite3'. That literal is the named mechanism by which #18172 reached two published releases: every DELETE of an object targeted by a multiple: true reference answered 500 on PostgreSQL, always, and this pin stayed green throughout.

The file now declares a driver axis: the embedded SQLite cell plus a live PostgreSQL cell provisioned by OS_TEST_POSTGRES_URL. Everything below the one newDriver() seam is written once and measured on both.

packages/runtime/src/expected-read-refusal-noise.ts had to move with it, and that is declared here rather than buried — see In-place repair below.

The measurement — this pin was shown to go RED before it was allowed to be green

The acceptance bar was not coverage. Ablation: SqlDriver.applyJsonMembership made to answer false unconditionally behind a runtime-evaluated marker, so the cascade probe's $contains falls through to the pre-#17590 substring emitter. driver-sql rebuilt each leg (runtime's tests resolve @objectstack/driver-sql through exports, i.e. dist/), and scripts/ablation-dist-preflight.mjs used to prove the mutation reached the artifact before any colour was read.

mutate  -> on-disk anchor 1, marker 1; blob d25e03f4 vs HEAD 2a17fc14
        -> rebuild -> preflight: marker present in 2 built files
        -> vitest: 6 failed | 9 passed (15)
           ALL SIX failures in "(live postgres)" — ZERO in "(better-sqlite3)"
restore -> git checkout HEAD -- THE_PATH; git diff HEAD empty; marker 0 on disk
        -> rebuild -> preflight --absent: marker absent from all 6 built files,
                      working tree clean against HEAD
        -> vitest: 15 passed (15)
        -> final blob 2a17fc14 == HEAD blob

The fault reproduced byte for byte, on a live PostgreSQL 16.13 with timezone=Asia/Shanghai:

[sql-driver] DATABASE_ERROR - the backend refused a read on 'zz_field_zoo' (42883).
  ... select * from "zz_field_zoo" where "f_lookups" LIKE $1 ESCAPE $2
      - operator does not exist: json ~~ text
Serialized Error: { code: '42883', file: 'parse_oper.c', routine: 'op_error' }

That asymmetry is the whole card. A multiple: true lookup is a TEXT column on SQLite and a real json column on PostgreSQL — measured through information_schema on the live server, and now asserted as this cell's non-vacuity guard. On TEXT the membership lowering and the substring lowering are indistinguishable, so no assertion written against SQLite can separate them. Only the live cell can, and now it does.

Without a server

The unprovisioned cell is a NAMED skip that says which variable would run it, never a silent omission — the suite is emitted either way, because a cell that emits nothing at all is not a skip and vitest's summary counts would read as coverage. Under OS_EXPECT_LIVE_DIALECT_MATRIX=1 the missing URL is a failure instead, so a runner that declared it provisioned a server cannot quietly degrade to SQLite-only. Measured: the full @objectstack/runtime suite without a URL reports 3661 passed | 1 skipped, and that one skip is this cell naming itself.

⚠️ Read the limit honestly: a named skip is a report, not coverage — see Not done here.

Isolation

The live cell owns a PostgreSQL schema named from this file's repo-relative path (os_lv_cascade_delete_multivalue_lookup_r_b7005a0a8835), recreated per test and dropped in afterAll. Object names here are short and generic (zz_account, zz_guard) and CI provisions ONE server for every live leg, so a shared schema would not be contention but destruction. Same derivation as driver-sql's live-dialect-matrix.testkit.ts and metadata-protocol's live-mysql-database.testkit.ts — same os_lv_ prefix, same 34-character slug cap, same 12 hex of sha256 over the workspace-relative path — so the copies stay jointly injective on that one server. pnpm check:live-db-isolation green.

In-place repair, declared: the noise capture recognised only SQLite

expected-read-refusal-noise.ts matched its reason half against the literal no such table: TABLE_NAME, which is SQLite's phrasing and only SQLite's. On PostgreSQL the driver writes relation "sys_organization" does not exist, so the fail-soft tenancy probe's refusal was never recognised: the capture printed the noise it exists to withhold AND silentChannels() reported the channel silent. Measured — all eight cases of the live cell red on that assertion, with the driver's (42P01) line sitting in the log immediately above it. Relaxing the pin is explicitly forbidden by its own docblock, and the pin was not wrong; the recogniser was SQLite-shaped.

So the reason half became the caller's: MissingTableReason, defaulting to SQLite's sentence so all eighteen existing call sites are byte-unchanged, with the PostgreSQL spelling exported beside it and this matrix picking per cell through a Record keyed on the cell id — a new cell cannot be added without answering the question. Neither half is widened: the envelope still pins the table positively and the reason must still be that dialect's missing-table sentence about that same table, so a permission denial, a dropped connection or a syntax fault still fails it on every dialect.

⚠️ The first cut reached for isMissingTableError in @objectstack/types instead, and that was measured and withdrawn. This module is imported by RELATIVE path out of trigger-record-change and plugin-approvals, so a bare workspace specifier added to it lands in THEIR resolution domain: check:test-source-alias went red naming @objectstack/trigger-record-change: NEW unaliased artifact import(s) ... @objectstack/types, and green again on the reverted tree (controlled revert, both directions run). The gate's prescribed repair is an alias in those packages' vitest configs — outside this card's file surface and a different defect class — so the design changed instead of the surface.

MySQL is deliberately absent from that vocabulary: its sentence is database-qualified (Table 'db.t' doesn't exist), the plain fragment form cannot carry it, and no fixture here rigs MySQL. Declaring an entry nothing exercises is the declared-not-enforced trap. It arrives with the fixture that needs it.

Not done here: the CI leg (outside this card's file surface)

⚠️ The Temporal Conformance (live PG + MySQL) job runs driver-sql, the non-SQL temporal backends, and metadata-protocol. It does NOT run @objectstack/runtime, so nothing in CI hands this cell a URL and the cell will report itself un-run on every job until that changes. The honest wiring is two steps in .github/workflows/ci.yml, in the job that already provisions the postgres service:

      - name: Build runtime and its dependencies
        run: pnpm exec turbo run build --filter=@objectstack/runtime... --concurrency=4

      - name: Run the runtime cascade-delete matrix against live PostgreSQL
        env:
          OS_TEST_POSTGRES_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres
          OS_EXPECT_LIVE_DIALECT_MATRIX: '1'
        run: |
          pnpm --filter @objectstack/runtime exec vitest run --project local \
            cascade-delete-multivalue-lookup-real-driver

The positional is a SUBSTRING, not a glob — the same reading the metadata-protocol step records for itself, where the glob form matched zero files. .github/workflows/** is outside the declared surface for this card, so no workflow is edited here; this is reported for the seat to place.

Does this fold into #18200?

Measured, and the reading is no. #18200 is about WHICH FILES a local green covers — a driver-sql run blind to 11 of its 188 files. This card is about WHICH DIALECT one file runs on. Running all 188 driver-sql files would not have caught #18172, because the only real-stack pin of the cascade path does not live in driver-sql at all; it lives in packages/runtime and it ran, green, on the one dialect that cannot fail. Two different mechanisms with the same symptom. #18200 is not addressed here and remains open.

Scope and grading

• Clause-②: no — measured, not assumed. Both changed files live in packages/runtime/src/ and neither is reachable from src/index.ts, which is tsup's single entry. Grepping the built artifact across the package's whole files[] (dist, README.md, CHANGELOG.md): captureExpectedReadRefusals, POSTGRES_MISSING_TABLE_REASON, MissingTableReason, zz_field_zoo, os_lv_, OS_TEST_POSTGRES_URL — 0 files each. Positive control on the same built tree: AppPlugin 6 files, DriverPlugin 4. Nothing published moves.
• skip-changeset — same measurement. No released package ships anything this diff touches.
• needs:contract-review is the seat's label; this PR neither hangs nor removes it.

Verification

Run on bb71ba4526 (this branch merged with origin/main through scripts/pm/os-regen-merge.sh), every heavy run through scripts/pm/os-verify-lock.sh.

what	reading
@objectstack/runtime suite (no PG URL)	265 files, 3661 passed | 1 skipped
the matrix file, live PG + OS_EXPECT_LIVE_DIALECT_MATRIX=1	15 passed (15) — 7 SQLite, 8 live postgres
ablation, live PG	6 failed | 9 passed — all six in the live cell, none in SQLite
@objectstack/runtime typecheck	green (test layer 27 files / 191 errors / 69 pinned signatures, unchanged)
@objectstack/trigger-record-change test	101 passed (101) — cross-package consumer of the changed helper
@objectstack/plugin-approvals test	764 passed (764) — same
@objectstack/spec check:generated	all 15 generated artifacts up to date (post-merge)
derived gate families (scripts/pm/dispatch-gates.mjs)	50 derived, 49 run green, 1 NOT MEASURED
pnpm check:live-db-isolation	green (outside the derivation; run anyway)
eslint . --no-inline-config	exit 0 over the whole population — 6822 files, 0 findings, on bb71ba4526

pnpm check:dual-build-cjs-loads is the one NOT MEASURED: it exits 3 with PREREQUISITE NOT MET because it reads built output for ~30 packages this worktree never built. That is not a pass and not a finding; CI builds the repo and measures it there.

Acceptance notes

Observations found on the way, filed nowhere and fixed nowhere, per Prime Directive #10:

• 29 other test files under packages/runtime/src/ also hard-code client: 'better-sqlite3'. noted, not filed — none of them carries [finding] The only real-stack pin of the multi-value cascade-delete path hard-codes better-sqlite3 — the named mechanism by which #18172 (p1, PostgreSQL) shipped in two releases #18617's receipt (a dialect-specific defect that shipped), most pin behaviour with no dialect axis at all, and converting them wholesale would be exactly the scope expansion the directive forbids. The carrier for the next one is whichever card names a dialect-specific defect on that path.
• expected-read-refusal-noise.ts is imported by RELATIVE path from two packages outside packages/runtime (trigger-record-change/src/record-change-integration.test.ts, plugin-approvals/src/status-mirror-cascade.integration.test.ts), which is what makes any bare workspace import added to it a change to their resolution domains. noted, not filed — it is a coupling, not a defect, and it is now recorded in the module's own header where the next author will meet it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime, touching 6 documentable anchor(s).

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/deployment/cli.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/deployment/seed-tenancy-repair.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/permissions/administrator-guide.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/protocol/kernel/config-resolution.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/protocol/objectql/schema.mdx (via sys_organization (literal, a string literal in a comment on a changed line))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/releases/v17/17-1.mdx (via sys_organization (literal, a string literal in a comment on a changed line))
• content/docs/releases/v17/17-4.mdx (via sys_organization (literal, a string literal in a comment on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 26 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 080688b561417fcbe6f3d28f88bac73a0c06b953 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e76e3d54a3bcd89ce6bfe48b4f21f3f080fa0262 — the merge of head bb71ba4526415b16d2adc1cbb0201ec6a8383b46 into base 080688b561417fcbe6f3d28f88bac73a0c06b953, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e76e3d54a3bcd89ce6bfe48b4f21f3f080fa0262 && git checkout e76e3d54a3bcd89ce6bfe48b4f21f3f080fa0262
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 080688b561417fcbe6f3d28f88bac73a0c06b953 bb71ba4526415b16d2adc1cbb0201ec6a8383b46 && git checkout -B drift-repro 080688b561417fcbe6f3d28f88bac73a0c06b953 && git merge --no-ff bb71ba4526415b16d2adc1cbb0201ec6a8383b46

node scripts/docs-audit/affected-docs.mjs --json 080688b561417fcbe6f3d28f88bac73a0c06b953

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 080688b561417fcbe6f3d28f88bac73a0c06b953 → pass the list as
args.docs, on the commit named under Which tree this was computed on.