[objectstack-fleet]

Fixes #23479
Clause-②: no

What changed

os meta delete's default (human) output now reads the reset door's reset flag. The --format json and --format yaml outputs already report that flag as deleted. Until now the human output printed its success line without reading it.

packages/cli/src/commands/meta/delete.ts, run()'s human branch:

• reset: false means the delete's address held no row, so nothing was removed. In that case the command prints a warning line, built from the flags it sent:

Run	Before	Now
os meta delete view x, nothing stored	✓ Metadata deleted: view/x	⚠ Nothing deleted: view/x — the server found nothing to delete
... --package P, P holds no row of it	✓ Metadata deleted: view/x	⚠ Nothing deleted: package 'P' holds no row of view/x
... --draft, no pending draft	✓ Pending draft discarded: view/x	⚠ Nothing discarded: view/x has no pending draft
... --draft --package P, P holds no pending draft of it	✓ Pending draft discarded: view/x	⚠ Nothing discarded: package 'P' holds no pending draft of view/x

• reset: true: the success line is unchanged, byte for byte, including with --package.
• The flag is read as === false, not as falsiness. false is the door's positive "nothing was removed" (DeleteMetaItemResponseSchema). An absent flag carries no signal, and reading it as "nothing deleted" would deny a deletion that really happened. The sibling os data delete reads its flag the same way ([finding] os data delete 的默认人读输出无条件打印「Record deleted」—— #19411 落地后它会与同命令的 --format json 臂给出相反的事实 #19413).
• Each no-op sentence claims only what the door's own no-op receipt claims for that address (ObjectStackProtocolImplementation.deleteMetaItem's reset: false returns). With --package P, the door's receipt is "No row of TYPE/NAME is bound to package 'P', so nothing was deleted", and on --draft it is "No pending draft of TYPE/NAME is bound to package 'P'". The command names no cause it did not read: it does not say "already at artifact default", and it does not say which package holds the row instead. The package id is quoted verbatim, as it was sent.

The no-op exit code: measured, unchanged (0)

The command already declares a no-op as a completed command that exits 0:

• Its JSON and YAML outputs publish success: true (the CLI envelope's "the command completed") beside deleted: false. The [#13023] note in run() defines the two booleans that way.
• delete-reset-carriers.test.ts already pins two real-door no-ops at exit 0: "NAMING A PACKAGE THAT HOLDS NO ROW" (--format json, deleted: false) and "--draft parses" (a --draft reset of view/nothing_here).
• Measured on the new head through the real door (probe below): the human output also exits 0 on all five no-op runs.
• Neither the command's docblock nor content/docs/deployment/cli.mdx declares a different code for os meta delete. cli.mdx has no os meta delete entry.

So the exit code stays 0 on both values and all three formats. Moving only the human output off 0 would re-create the disagreement one layer down. Moving all three would narrow a published CLI accept set, so it is not done here. The sibling os data delete made the same call for the same reason (#19413). Failures (a refusal or a transport error) still exit 1, and the pin file has a control for that.

Pins: packages/cli/src/commands/meta/delete-noop-line.test.ts (unit tier)

The pins drive the real oclif command and a real ObjectStackClient whose fetch returns a canned receipt from the door. The receipts use the shapes and sentences of the door's own delete and no-op returns. There are four argv variants: no flag, --package, --draft, and --draft --package.

• POSITIVE CONTROL: both receipts reach the command through the real SDK verbatim, with reset intact.
• reset: true: each variant's whole output equals its success line, and the exit code is 0. Negative control: no Nothing deleted or Nothing discarded text appears.
• reset: false: each variant's whole output equals its no-op line, and the exit code is 0. Negative control: no Metadata deleted, no Pending draft discarded, and no success glyph.
• --package P names P, verbatim, and only P. Negative control: the package-less no-op line names no package.
• All three formats state the same fact: JSON deleted, YAML deleted, and the human line agree for every variant and both values. humanClaim refuses an output that says neither sentence, or both.
• Exit code 0 on both values × three formats × four variants. Control: a 500 from the transport still exits 1.

Ablation (one-off, not kept)

The fix was committed first. Then node scripts/ablation-replace.mjs mutated the anchor if (result.reset === false) { to if (false) {, which restores the unconditional success line. It ran the pin file in WRAP mode under the verify lock:

ablation-replace: anchor   x1 -> x0
ablation-replace: replace  "if (false) {"  x0 -> x1
ablation-replace: blob     291bceebf307... -> 16421ba34632...
 ✓ POSITIVE CONTROL — both receipts reach the command through the REAL SDK, verbatim
 ✓ `reset: true` — the success line, byte for byte, on every variant
 × `reset: false` — the no-op line, and NOT the success line
     + "out": "  ✓ Metadata deleted: view/nothing_here",
 × `--package P` names P, verbatim, and only on the no-op line
 × all three arms state the SAME fact, for one and the same receipt
 ✓ the exit code is `0` on BOTH values and all three formats
 ✓ a genuine transport failure still exits 1
 Tests  3 failed | 4 passed (7)
ablation-replace: ok restored: blob == HEAD (291bceebf307) and `git diff HEAD` is empty

The direction is red, as predicted. The three cases that read the reset: false branch go red. The four that do not (the control, the reset: true pin, the exit-code pin and the transport control) stay green. The subject is imported relatively (./delete.js, from src), so no dist/ rebuild was involved.

Real-door probe (one-off, not kept)

This is the card's two repros plus the draft no-op and a delete-ful control. They ran through the real RestServer, ObjectStackProtocolImplementation and SQLite sys_metadata, using the harness from delete-reset-carriers.test.ts, on head c52520177f:

PROBE nothing_here:                "  ⚠ Nothing deleted: view/nothing_here — the server found nothing to delete" exit 0
PROBE nothing_here json:           { "success": true, "type": "view", "name": "nothing_here", "deleted": false } exit 0
PROBE --package gamma:             "  ⚠ Nothing deleted: package 'com.qa.gamma' holds no row of view/probe_v" exit 0
PROBE --package gamma json:        { "success": true, "type": "view", "name": "probe_v", "deleted": false } exit 0
PROBE --package none stored:       "  ⚠ Nothing deleted: package 'com.qa.gamma' holds no row of view/probe_none" exit 0
PROBE --draft none:                "  ⚠ Nothing discarded: view/probe_d has no pending draft" exit 0
PROBE --draft --package none:      "  ⚠ Nothing discarded: package 'com.qa.gamma' holds no pending draft of view/probe_d" exit 0
PROBE control:                     "  ✓ Metadata deleted: view/probe_ok" exit 0

In the same run, delete-reset-carriers.test.ts (integration tier, real door) was green: 2 files, 34 tests.

Verification

All of the following ran on head 41060487d3, after the final commit. The code has not changed since the ablation and the probe, which ran on c52520177f. Exit codes were captured before any pipe. Heavy runs went through scripts/pm/os-verify-lock.sh.

• Build: pnpm turbo run build --filter='@objectstack/cli^...' --concurrency=2 built the dependency closure (VERDICT command-exit 0). A full pnpm turbo run build --filter='!@objectstack/docs' --concurrency=2 followed (VERDICT command-exit 0, 75/75 tasks), because the dist-reading gates and two CLI pins need every package built.
• pnpm --filter @objectstack/cli typecheck: exit 0. The new pin file is in that tsc program: tsc --listFilesOnly -p tsconfig.json lists src/commands/meta/delete-noop-line.test.ts, and check:test-typecheck reports its debt ledger held.
• pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2: 288 of 290 files and 4295 tests passed (29 skipped). The 2 failed files were test/published-subpath-console.pin.test.ts and test/published-subpath-hook-body.pin.test.ts. Both refused at load with "packages/cli is not built (./dist/index.js is absent)", a prerequisite and not a finding. They were re-run after the full build: 2 files and 29 tests passed (exit 0). The integration tier is declared to CI. Locally I ran only delete-reset-carriers.test.ts from it, in the probe run above: green, 2 files and 34 tests.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 64 commands, and all 64 were run. Four refused on the first pass with exit 3 (PREREQUISITE NOT MET, unbuilt dist): check:dual-build-cjs-loads, check:i18n, check:i18n-coverage and check:i18n-walk-parity. After the full build they were re-run with exit 0. check:dts-closure, check:lean-entry-closure, check:published-files and check:sourcemap-no-sources-content were also re-run on the built tree: exit 0. --ran reconciliation: "64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN" (a derived zero; every line carries its exit code).
• pnpm lint (the whole-repo eslint . --no-inline-config): exit 0, no findings.
• Control-byte self-scan of the three changed files: no matches.

Acceptance notes

• Not surfaced on any output: the door's message. The no-op receipt carries a sentence that names what remains, for example "package 'com.qa.alpha' still holds a row". The JSON and YAML outputs drop it too ({ success, type, name, deleted }). Surfacing it would be a new output key or line, which is outside this card. This is an observation, not filed.
• The legacy raw-engine path (read-only inference, not exercised). On a control-plane kernel, for a code-only type, the door's legacy branch matches the row by type, name and organization only. It does not read state or packageId. So a --draft or --package reset there would remove whatever row it finds, and the CLI would print the --draft success line. This is dormant: it is not reached from an environment kernel, and draft or packaged rows of job or agent are not writable. It is not filed, and is noted here for the reset-door owner.
• The new pin file is unit tier (it imports no driver and constructs no ObjectQL). The integration-tier delete-reset-carriers.test.ts is untouched; its success-line assertions are reset: true runs and still hold.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 3 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v17/17-3.mdx (via os meta delete (command, read off packages/cli/src/commands/meta/delete.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 28 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b57228913aecc0988f704dbf6b9549c3324d8ebc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8c35679af61c806b565bde823e8b0965502e1c58 — the merge of head 41060487d3ec9e7281ece57eab5c07f3bf0061e8 into base b57228913aecc0988f704dbf6b9549c3324d8ebc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8c35679af61c806b565bde823e8b0965502e1c58 && git checkout 8c35679af61c806b565bde823e8b0965502e1c58
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b57228913aecc0988f704dbf6b9549c3324d8ebc 41060487d3ec9e7281ece57eab5c07f3bf0061e8 && git checkout -B drift-repro b57228913aecc0988f704dbf6b9549c3324d8ebc && git merge --no-ff 41060487d3ec9e7281ece57eab5c07f3bf0061e8

node scripts/docs-audit/affected-docs.mjs --json b57228913aecc0988f704dbf6b9549c3324d8ebc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b57228913aecc0988f704dbf6b9549c3324d8ebc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

✅ ACCEPT: PR #23557 at 41060487d3 (#23479). It lands on an all-green head; no contract review is owed · 2026-10-15T00:12Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6180747022. Report: the os-dev-report on #23479. Thread-read: that report.

Checklist, read against GitHub and origin/main, not against the report:

• PR shape: draft, base main, title fix(cli):, assignee sunhaolin. Line 1 is Fixes #23479, the body's only closing keyword. Line 2 is Clause-②: no.
• Scope: 3 files, +390 / −10, inside the claim's surface:
  • run()'s output branch of packages/cli/src/commands/meta/delete.ts, plus a module-private noOpLine helper;
  • one pin file;
  • one changeset.
  • check-governed-merges --pr 23557: NOT governed. Merge-tree is clean against origin/main 7ffc57846a.
• The fix, read in the diff:
  • The human arm reads the same result.reset that the JSON and YAML arms lower into deleted. It reads it as === false, the door's positive "nothing at that address", never as falsiness.
  • On false it prints a warning built only from the flags it sent:
    • nothing to delete;
    • package 'P' holds no row;
    • no pending draft, under --draft;
    • P holds no pending draft.
  • It names no cause it did not read.
  • The reset: true lines are byte-identical, including os meta delete cannot pin a reset or discard only the pending draft — the CLI stays one layer behind the SDK it calls #13024's --draft sentence.
  • The sibling os data delete took the same reading ([finding] os data delete 的默认人读输出无条件打印「Record deleted」—— #19411 落地后它会与同命令的 --format json 臂给出相反的事实 #19413).
• Exit code, measured and unchanged: 0 on both values and all three formats.
  • This command already declares a no-op as a completed run: its JSON and YAML publish success: true beside deleted: false.
  • delete-reset-carriers.test.ts pins two real-door no-ops at exit 0.
  • So the grade stays Clause-②: no, as claimed.
• Pins and reverse verification:
  • delete-noop-line.test.ts has 7 cases through the real oclif command and the real SDK, over four argv variants, with positive and negative controls. The three output faces agree.
  • Ablating the reset === false branch turns the 3 false cases red, while the controls stay green. The restore is proven against HEAD.
  • A one-off real-door probe (RestServer, protocol, SQLite) printed each of the four warnings at exit 0, and a real delete still printed the success line.
• Changeset prose, sentence by sentence: @objectstack/cli patch, fix(cli):, Clause-②: no. The FROM → TO table and the "Unchanged" paragraph (success line byte-identical, exit 0 both ways, failures still exit 1) match the diff and the readings.
• Gates:
  • Local, at 41060487d3: 64 derived, 64 run, 0 unmeasured. Four prerequisite exits were rerun to 0 after a full build. Whole-repo pnpm lint exited 0, and the CLI typecheck exited 0.
  • Gate evidence: the check-runs pinned to 41060487d3, read at this stamp. There are 37 runs: 17 success, 6 skipped, 14 still running, and none failed. Landing reads them again.
• Contract review: none owed. The diff touches none of the three faces: CLI human output, Clause-②: no, no schema, no governed path.

Accepted deviations:

• The worktree base is 086fa4640f, not the dispatch's anchor. The one commit between them is disjoint.
• Whole-repo pnpm lint was run.
• A full build was run, beyond the closure, because of prerequisite exits.
• The ablation and the probe ran on the fix commit. The next commit is changeset-only, and the delete.ts blob is identical.

Out-of-scope, both Acceptance notes, 「承接者:无」:

• The door's no-op receipt message is surfaced on no output; surfacing it would be a new output key.
• The legacy raw-engine reset path ignores state and packageId. That is read-only inference, dormant and unreachable from an environment kernel, so it has no reach:.

Landing: pr_ready + automerge_enable through the relay once every check on the current head is success or a roster skip.

---

Generated by Claude Code