[objectstack-fleet]

Fixes #24253

Clause-②: yes (widening) (a request key on a published protocol method and its door, and a response key in packages/spec/src/**; owes one CONTRACT_REVIEW_TIER review before the queue)

Dispatched by the domain:engine seat 1 PM (session_01JtSQQ3EWsbNPzyYMug1tXy); implemented by the os-dev session session_01DtBADZFvLxnZCFFDWCy87D on the claim in comment 6245957326.

What changes

publishPackageDrafts takes an opt-in backfill: Array of { object, field }. Each entry names a field this publish adds. Once the drafts are live, that field's literal defaultValue is written into the object's existing rows whose value is absent. The writes run as the caller, and the response reports the rows written per field under backfillApplied.

• packages/metadata-protocol/src/protocol.ts (publishPackageDrafts and two private helpers beside it):
  • readPublishBackfillRequest judges the request's shape before any server state is read. The shape must be an array of { object, field } pairs, each named once, with no other keys. A non-empty backfill needs the caller's context.
  • planPublishBackfill runs after listDrafts and before anything is promoted. An entry is honoured only when all four hold: the package holds an object draft of that name; the draft declares the field; the object the engine serves today does NOT have the field; and the field declares a literal defaultValue.
  • A runtime token (NOW(), current_user) or an expression envelope is resolved for each insert against that insert's context. There is no single value to stamp into rows that other people wrote at other times, so those defaults are refused too.
  • All failing entries are returned in ONE 400 VALIDATION_ERROR, with one issues[] entry per problem at path backfill.N. Nothing is promoted and no row is written.
  • applyPublishBackfill runs after every promoted item's side effects. For each field, it reads { field: { $null: true } } 200 rows at a time as the caller, then writes that page through updateManyData with the caller's context. updateManyData is the bulk face of the by-id PATCH, so permissions, RLS/FLS, validation and record hooks run per row, as on that caller's own edit.
• packages/runtime/src/domains/packages.ts: the POST /packages/:id/publish-drafts door passes body.backfill through as sent, together with _context.executionContext (the request's own principal, never a system one). A body without the key sends neither key.
• packages/client/src/index.ts: packages.publishDrafts(id, { backfill }).
• packages/spec/src/api/protocol.zod.ts: PublishPackageDraftsResponseSchema.backfillApplied declares { success, fields: [{ object, field, updated, error?, code? }] }. Without it, the declared parse would strip the key. The generated protocol reference, the authorable-surface shard and the strictness-ledger count were regenerated by check:generated --fix (442 → 444 response z.object sites).
• Four minor changesets: @objectstack/metadata-protocol, @objectstack/runtime, @objectstack/client and @objectstack/spec. @objectstack/objectql is touched by tests only, and its files[] ships dist/ alone.

Where the write lives, and why (H2 measured)

The dispatch's H2 hypothesis was that only the door holds the caller's context, so the door would have to perform the writes. Measurement on fb6fb24 falsified the premise behind it.

The protocol's own data methods already take the caller's ExecutionContext from every door: callData hands _context.executionContext to protocol.updateData / updateManyData / findData. plugin-security's CRUD/RLS/FLS middleware and the record hooks read it there.

So the write lives in the protocol, and the door passes the request's context with the key. This keeps one implementation for every caller of the method. A caller without a context is refused, and the write is never performed as the system. The door half is pinned (it sends _context.executionContext, and isSystem is unset).

Premise measurement: the SQL driver already fills existing rows

Measured on a live pnpm dev:crm -- --fresh backend (SQLite, SqlDriver(better-sqlite3)) at base fb6fb24, before any change:

• A package was created, an object published, and 12 rows inserted.
• A draft then added done: boolean, defaultValue: false and was published with no backfill.
• Result: all 12 rows read false, and ?done=false matched 12.
• sqlite_master showed done boolean default '0', and the stored values were integer 0 × 12.

The cause is that ALTER TABLE … ADD COLUMN carries the literal default (applyDeclaredColumnDefault), and the database fills existing rows with it.

The gap is real on the drivers without a column DEFAULT:

• Turso's remote transport: columnDeclarationSQL emits no DEFAULT, and its own docblock records the asymmetry.
• The memory and MongoDB drivers, which are schemaless.

Cloud's case (cloud#2656 / #1586) is the first of these. So on the SQL driver backfillApplied.fields[].updated is a truthful 0, and the spec describes that.

The card's Done-when is therefore pinned on a real ObjectQL engine over a store without column defaults. On a SQL backend it would pass vacuously.

Mechanism hypotheses, measured

• H1, the order: holds. The backfill runs after runPublishSideEffects has run for every promoted item. That step does two things: applyRegistryWriteThrough, without which the engine would serve no new field and strip the write; and ensureObjectStorage → syncObjectSchema, which adds the column. A sync refused there is logged at error and the publish continues. The backfill's write then fails and is reported per field. It is never skipped.
• H2, as the caller: the premise is falsified (see above). The caller's context does reach the protocol. Pinned: the CRUD middleware seam and a beforeUpdate hook each see userId = the caller, with isSystem not set, once per row.
• H3, what may be named: holds, plus one case. "New" means a field absent from the object the engine serves (registry.getObject(object).fields, injected system fields included) and present in this batch's draft. Unknown object, unknown field, not-new, no default, and a token or expression default are each refused by path, all in one answer, before promotion. The extra case is the token/expression refusal, decided by the axes below.
• H4, which rows: holds. Only rows whose value is absent are written, a page of 200 at a time. A value already stored is neither overwritten nor counted (pinned: 11 of 12). With 205 rows, the reads are two full pages plus a final empty one.
  • A row a hook leaves empty stops the field instead of looping on it. So does a write whose field the engine dropped (droppedFields).
  • A residual window remains between a page's read and its by-id write. A value a user writes to that row inside that window would be overwritten. updateData writes by id only; no conditional by-id update exists on this face.
• H5, a failure midway: settled as loud and per field. The promotion has committed and is not rolled back. A field stops at its first failing row, and its element carries updated (the rows written so far), error (the record and why) and code (the refusal's ADR-0112 code, e.g. PERMISSION_DENIED). Other fields still run, and backfillApplied.success is false. The failure reaches the caller in the 200 body, so by AGENTS.md "Degradation log levels" it is not a degradation, and the server log carries a warn line. Pinned in the test suite.

Verification record (head 08c87b8d0, after merging origin/main a422f04fe)

Tests:

• New packages/objectql/src/publish-package-drafts-backfill.test.ts (10 cases, real ObjectStackProtocolImplementation on a real ObjectQL engine):
  • The card case: a boolean with defaultValue: false over 12 rows reads 12 false, and the receipt is updated: 12.
  • No key, no write.
  • A field with no default is refused with 400 VALIDATION_ERROR at backfill.0, and the draft stays pending.
  • Four entry refusals arrive in one answer.
  • The shape refusals: non-array, unknown key, duplicate, no context.
  • An existing value is kept.
  • Paging over 205 rows.
  • Caller context at the CRUD seam and in the hook.
  • A caller the update refuses gets updated: 0 with code: PERMISSION_DENIED, and the publish is kept.
  • A clearing hook stops the field.
• Producer conformance (objectql/src/publish-package-drafts-response-conformance.test.ts) gains one case: backfillApplied parses unstripped.
• Door conformance (runtime/src/domains/packages-publish-drafts-response-conformance.test.ts) gains four cases:
  • The key and the caller's context reach the protocol, and the receipt conforms.
  • A stopped field's error/code conform.
  • Without the key, neither key is sent.
  • The protocol's refusal answers 400 VALIDATION_ERROR with backfill.0, with no flip and no announce.
  • backfillApplied also joins the byte-stability absent-key list.
• Full suites on 08c87b8d0, every exit code 0:
  • pnpm --filter @objectstack/metadata-protocol test: 244 files, 20641 passed.
  • @objectstack/client: 52 files, 671 passed.
  • @objectstack/runtime: 416 files, 6549 passed.
  • @objectstack/objectql: 438 files, 8255 passed.
  • @objectstack/spec: 693 files, 21002 passed.
• pnpm --filter … typecheck for spec, metadata-protocol, runtime, client and objectql: each exit 0. objectql's and runtime's typecheck reach the test files through check:test-typecheck.
• pnpm --filter @objectstack/spec check:generated: exit 0, after --fix regenerated the two stale artifacts named above.

Live, over HTTP through the door (a pnpm dev:crm -- --fresh backend built from this branch, SQLite):

• A backfill naming flagged (no default) and title (not new) answered 400 VALIDATION_ERROR. details.issues named backfill.0 ("declares no defaultValue") and backfill.1 ("already exists on the published object"), and the live object's fields were unchanged.
• The publish with backfill: [done, score] answered 200 published, backfillApplied: { success: true, fields: [{ done, updated: 0 }, { score, updated: 0 }] }. The 12 rows read false / 7: the column DEFAULT had filled them, as measured above.

Ablations, one per mechanism. The mutations went through scripts/ablation-replace.mjs (wrap mode), and the dist legs were proven with scripts/ablation-dist-preflight.mjs (marker present, then --absent and tree clean on restore):

• A1, the write (applyPublishBackfill gated off): the backfill suite went red in 6 cases, the card case included.
• A2, the no-default refusal (that guard gated off): red in 1 case, "a field without a defaultValue is refused".
• A3, the door's context (context dropped from the pass-through, runtime source): red in 1 case, "reaches the protocol … with THIS caller's execution context".
• A4, the spec declaration. backfillApplied.fields[].updated was re-typed to a string. The producer conformance went red in 1 case and the door conformance in 2.
  • The first A4 attempt renamed the key. The spec build itself refused that (authorable-surface reports api/PublishPackageDraftsResponse:backfillApplied removed), so nothing reached dist/ and that leg was void. The objectql leg ran green against the old dist/ and is not counted. The preflight caught it, and the leg was redone as the type mutation above.

Gates:

• node scripts/pm/dispatch-gates.mjs --commands (no paths) on 08c87b8d0 derived 116 commands. Every line was run, and each exit code was captured before any pipe. The reconciliation is in the os-dev report on metadata-protocol: publishPackageDrafts takes an opt-in per-field backfill of existing rows with the new default, so a copilot draft that adds a field can fill existing records on publish (ruling A on cloud#2924) #24253.
• The earlier run on the pre-merge head (114 commands) found one real red: check:query-options-erasure. The new test cast engine options as any (test surface 236 → 237). It was fixed by typing them, and the gate is green.
• check:engine-split-ratio and check-plugin-teardown-shape --self-test first refused on the shallow clone. After git fetch --shallow-since=2026-07-13, both exit 0.

Decisions settled by the four axes (recorded for review)

• Token and expression defaults are refused rather than evaluated per row.
  • Business need: the measured consumers are booleans and literals (cloud#2656, the 「可选补 0」 card).
  • Long term: there is one meaning per default.
  • AI-proofing: a loud refusal beats stamping publish-time NOW() or the publisher's id into everyone's rows.
  • Startup scope: this is the narrowest claim the runtime fully honours.
• A context is required for any non-empty backfill. "As the caller" is unprovable without one, and a silent system write is the failure the ruling forbids.
• Fields are independent. One field's failure does not stop the others, and each element reports its own outcome.

Acceptance notes

• Turso remote, memory and MongoDB fill nothing on ADD COLUMN; the SQL driver does. This is the reason the opt-in matters on cloud. The Turso half is already recorded in remote-transport.ts columnDeclarationSQL's docblock and in turso-remote-not-null.test.ts. Carrier: none — not filed (a recorded, known asymmetry, outside this card).
• "As the caller" means the caller's visibility. On an organization-partitioned object, the read is the caller's, so rows outside the caller's RLS/tenant scope are not read and not counted. That is the ruling's own semantics. updated says what was written, never that the table is complete.
• The read→write window between a page's read and its by-id write is described under H4.
• No objectui or cloud change. discardPackageDrafts and every other verb are untouched.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/client, @objectstack/metadata-protocol, @objectstack/runtime, @objectstack/spec, touching 14 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/authorable-surface/api.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

16 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 53ef7524368075a1f64003b9dfb1609d3d206d69.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/authorable-surface/api.json) — pages documenting those are invisible to this run
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 150 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 53ef7524368075a1f64003b9dfb1609d3d206d69 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fb80737750734e3aa846deac70b0237879532270 — the merge of head 08c87b8d08d43a5ee4971b75143df93327696246 into base 53ef7524368075a1f64003b9dfb1609d3d206d69, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fb80737750734e3aa846deac70b0237879532270 && git checkout fb80737750734e3aa846deac70b0237879532270
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 53ef7524368075a1f64003b9dfb1609d3d206d69 08c87b8d08d43a5ee4971b75143df93327696246 && git checkout -B drift-repro 53ef7524368075a1f64003b9dfb1609d3d206d69 && git merge --no-ff 08c87b8d08d43a5ee4971b75143df93327696246

node scripts/docs-audit/affected-docs.mjs --json 53ef7524368075a1f64003b9dfb1609d3d206d69

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 53ef7524368075a1f64003b9dfb1609d3d206d69 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 08c87b8d08d43a5ee4971b75143df93327696246
Local-runs: none
Scope: packages/spec/src/api/protocol.zod.ts + packages/metadata-protocol/src/protocol.ts (publishPackageDrafts, readPublishBackfillRequest, planPublishBackfill, applyPublishBackfill, publishBackfillRefusal; updateManyData and runUpdateManyLoop read as the write's seam), packages/runtime/src/domains/packages.ts (the POST /packages/:id/publish-drafts door, requireManageMetadata, the errorFromThrown catch), packages/client/src/index.ts (packages.publishDrafts), packages/runtime/src/route-ledger.ts (the publish-drafts row, unchanged), packages/spec/authorable-surface/api.json, content/docs/references/api/protocol.mdx, docs/audits/2026-07-unknown-key-strictness-ledger.counts/api.md, packages/spec/src/data/default-value-shape.ts (discriminateDefaultValueShape), packages/metadata-core/src/item-key-discriminators.ts (ITEM_KEY_DISCRIMINATORS), the three test files and the four changesets (the changesets as prose for ② only)

Inputs: card #24253 (body, claim 6245957326, dispatch 6245999954, os-dev-report 6247063019), PR #24269 (body, 14-file list, the one docs-drift advisory comment 6246776048, no review comments, no reviews), the net diff origin/main...08c87b8d0 after git fetch (merge-base a422f04; 14 files, +905/-6), and the check-runs on the head. Not the dispatch order.

Check-runs on 08c87b8d0: 41 runs. At my first read (about 07:21Z) Test Core (3/6) and (4/6) were in progress and every other run was complete; at 07:31:29Z all 41 are complete: 36 success, 5 skipped by selector (Console Pin Gate, Dogfood Regression Gate matrix shard, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance), 0 failure. The gates this schema change owes are green by name: Check Changeset (runs check-changeset-no-major.mjs), Type Check · source gates (runs spec check:authorable-surface and check:docs, the generators of api.json and protocol.mdx), Spec property liveness (runs spec check:strictness-ledger), Build Core (the spec build whose authorable-surface check refused the A4 key-rename ablation), Lint · scoped · query-options erasure, Governed Surface Queue Guard, Test Core 1/6 to 6/6.

① Derived judgments

Request keys, protocol face (publishPackageDrafts(request)):

• backfill — an optional array of { object, field } pairs. RIGHT. undefined reads as nothing asked and so does []; neither touches a row nor emits backfillApplied. Each entry is judged for shape before any server state is read (readPublishBackfillRequest), then for meaning after listDrafts and before anything is promoted (planPublishBackfill).
• context — the caller's execution context, typed unknown, required when backfill names anything. RIGHT as a widening of the in-process request. It is NOT a wire key: the door never reads body.context; it sets context from _context.executionContext only when body.backfill !== undefined. So on HTTP the only new request key is backfill, and no HTTP caller can supply a principal. A non-empty backfill with no object context is refused at path backfill (custom) and is never written as the system.
• Door and client agree: the client sends JSON.stringify(opts ?? {}), so the body is { actor?, backfill? }; the door reads body.actor and body.backfill; the protocol validates backfill. The client's backfill element type { object: string; field: string } is the protocol's. The client's return type is spec's inferred PublishPackageDraftsResponse, so it gains backfillApplied without a second declaration. No PublishPackageDraftsRequest* schema exists in spec and no route-ledger row carries a requestSchema field, so no request-side declaration was owed. RIGHT.

Response key backfillApplied (PublishPackageDraftsResponseSchema):

• Declared { success: boolean; fields: [{ object: string; field: string; updated: integer; error?: string; code?: string }] }, .optional(), describe-only, no .default(). The producer's PublishBackfillReceipt is member-for-member the same; updated is a counter incremented from 0, so .int() holds. RIGHT.
• Every exit, checked against the producer:
  • no key or []: backfillApplied is omitted (...(backfillApplied ? { backfillApplied } : {})), so a caller without the key gets the same bytes as before; the door sends neither backfill nor context. Pinned by the producer's "no key, no write" case and by the door's byte-stability absent-key list. RIGHT.
  • success: { success: true, fields: [{ object, field, updated }] } with no error/code keys present. RIGHT.
  • a refusal (shape or plan): thrown as Error & { code: 'VALIDATION_ERROR', status: 400, issues } before promotion; the door's deps.errorFromThrown(e, 500) carries .status and .issues to a 400 body; no 200 body exists, so the key "never reports a refusal" as its describe says. RIGHT.
  • a permission-denied caller: updateManyData returns success: false with the row's errors[0].code = PERMISSION_DENIED; the field's element is { updated: 0, error, code: 'PERMISSION_DENIED' } and success: false; the publish stands. RIGHT, pinned.
  • a partial (a hook clears the value, the engine strips the field via droppedFields, or any throw): the field stops with updated so far, error through clientFacingFailureText (the ADR-0112 withhold), code through clientFacingFailureCode when one is declared; other fields still run; success: false. RIGHT, pinned.
  • the batch did not publish (outcome: 'refused', published: []) with a non-empty plan: the key is absent and nothing is written. Shape-correct; see ③ item 8 for the describe clause.

Refusals, each at its path, all collected into one 400 (issues[]):

• backfill not an array: backfill, invalid_type. RIGHT.
• entry not a plain object: backfill.N, invalid_type. RIGHT.
• entry with a key other than object/field (a value key included): backfill.N, unrecognized_keys. RIGHT — the value written is always the draft's own default, never caller-supplied.
• object or field not a non-empty string: backfill.N, invalid_type. RIGHT.
• object.field named twice: backfill.N on the second occurrence, custom. RIGHT.
• non-empty entries and no object context: backfill, custom. RIGHT.
• no object draft of that name among this package's pending drafts (canonicalMetaType(d.type) === 'object'): backfill.N. RIGHT — an entry cannot reach another package's objects.
• the draft declares no such field: backfill.N. RIGHT.
• the served object already has the field (registry.getObject(e.object).fields own-property, injected system fields included): backfill.N. RIGHT — only a field this publish adds may be filled, so no stored value is ever overwritten by this path.
• defaultValue undefined or null: backfill.N. RIGHT — the card's "a field without a defaultValue is refused in the request (loud, named)".
• discriminateDefaultValueShape(dv) is token or expression: backfill.N, naming which. RIGHT; the helper exists on the head at packages/spec/src/data/default-value-shape.ts:93 and is re-exported from @objectstack/spec/data.
• Ordering: the shape refusal precedes ensureOverlayIndex and listDrafts; the plan refusal precedes the namespace-prefix enforcement and the Phase 1 atomic writes; refuseOrganizationScopedWrite keeps first place. So both refusals leave every draft pending. RIGHT, pinned ("the draft is still pending" case).

Paging and the write:

• engine.find(object, { where: { [field]: { $null: true } }, limit: 200, context }), looped until an empty page. $null is a declared comparand operator (filter-comparand-operators.ts:39). No offset is needed because each written page leaves the null set. RIGHT; pinned at 205 rows = three reads at limit 200.
• Each page is written through updateManyData({ object, records: [{ id, data: { [field]: default } }], options: { continueOnError: false }, context }). runUpdateManyLoop threads context per row into engine.update with where: { id }, collects droppedFields, and breaks at the first failure; reconcileStoppedBatch appends NOT_ATTEMPTED rows after it; success is failed === 0. The producer counts only rows the engine reports success: true and whose returned data still holds the value, throws 403 when the engine dropped the field for this caller, throws 422 when a hook left it empty or when a row re-appears in the next page after being written (the loop guard). RIGHT; pinned (11 of 12 kept; the clearing hook stops the field with count 0).
• applyPublishBackfill runs after applySeedBodies, i.e. after runPublishSideEffects (registry write-through and ensureObjectStorage/syncObjectSchema) for every promoted item, and before probes. A refused sync leaves no column, the write fails, and the field reports it — never skipped. RIGHT (H1).
• The batch is all-or-nothing (ADR-0067 D2, Phase 1 atomic writes), so a non-empty published implies the backfill's object draft promoted; the field exists in the registry when the write runs. RIGHT.

As-the-caller semantics:

• The read carries the caller's context, so RLS and tenant predicates apply at the engine's middleware; rows outside the caller's visibility are neither read, written nor counted. The write carries the same context per row, so CRUD permission, RLS/FLS, validation and record hooks run as on that caller's own PATCH. Pinned: the middleware seam sees userId = the caller and isSystem not true once per row; a beforeUpdate hook sees { done: false } once per row. RIGHT; this is the card's "as the caller — object permissions and hooks fire as for a user edit".
• The door already requires isSystem or the manage_metadata capability (requireManageMetadata) before the route runs, so a backfill caller is at least a metadata manager; the per-row write is still judged against that caller. RIGHT.
• Security: no path writes a value other than the named field's literal default; no path writes a row the caller cannot read and update; no path runs as the system (the protocol refuses a context-less backfill, the door never fabricates one, body.context is never read); an entry cannot name an object outside this package's drafts or a field that already exists. discardPackageDrafts and every other verb are untouched by the diff.

Caller without the key: byte-for-byte unchanged. The door sends neither key; the protocol's only new work is readPublishBackfillRequest(undefined) returning []; the response spread adds nothing. body.backfill === null is passed through and refused 400 at backfill rather than silently ignored. RIGHT.

Route ledger: the POST /packages/:id/publish-drafts row is unchanged and still exact — responseSchema: 'PublishPackageDraftsResponseSchema', client: 'packages.publishDrafts', disposition: 'sdk'. Its note enumerates the DOOR's own mutations; backfillApplied is a protocol key carried through, not a door mutation, so no new note entry is owed. RIGHT.

Generated artifacts, each the generator's output for this schema change and nothing else:

• packages/spec/authorable-surface/api.json: one line, api/PublishPackageDraftsResponse:backfillApplied, inserted in sorted order between PublishMetaItemResponse:version and PublishPackageDraftsResponse:commitId. build-schemas.ts; gated by check:authorable-surface (Type Check · source gates, green) and the spec build (Build Core, green). RIGHT.
• content/docs/references/api/protocol.mdx: one table row for backfillApplied carrying the describe text verbatim, and one "Nested Shape" section with the success and fields rows (the ellipsis in the fields type is the generator's truncation of nested optional members). build-docs.ts; gated by check:docs (same job, green). RIGHT.
• docs/audits/2026-07-unknown-key-strictness-ledger.counts/api.md: api/ 442 to 444, the two new z.object sites (backfillApplied and its fields[] element). Gated by check:strictness-ledger (Spec property liveness, green). RIGHT.

Also read: the as never cast on the engine.find options follows the file's existing sites (findEnvironmentRows, lines 10674/10685/10699); Lint · scoped · query-options erasure is green. clientFacingFailureText (3846), clientFacingFailureCode (4034) and canonicalMetaType (369) exist on the head.

② Semver level

The diff widens four published packages and narrows nothing:

• @objectstack/metadata-protocol — two new optional request keys and one new optional response key on publishPackageDrafts. Changeset minor, Clause-②: yes (widening). Its prose states the two keys, the judge-before-publish rule with the token/expression refusal, the 200-row paging through updateManyData as the caller, the backfillApplied shape, the stop-at-first-failure and not-undone rule, and the SQL-driver updated: 0 note — each matches the diff. RIGHT.
• @objectstack/runtime — the door accepts a new optional body key and passes it with the caller's context. Changeset minor, yes (widening); prose matches (as sent, caller's context never system, 400 before anything published, receipt on 200). RIGHT.
• @objectstack/client — publishDrafts(id, opts) gains optional opts.backfill. Changeset minor, yes (widening); prose matches. RIGHT.
• @objectstack/spec — PublishPackageDraftsResponseSchema gains optional backfillApplied; a key the declared parse used to strip is now carried. Changeset minor, yes (widening); prose matches ("present only when the request named a backfill and the batch published"). RIGHT.
• @objectstack/objectql — touched by two test files only; its files[] ships dist, README.md, CHANGELOG.md, so nothing published changes and no changeset is owed. RIGHT.
  The PR body carries Clause-②: yes (widening), as does each changeset; AGENTS.md's rule (yes takes at least minor; no narrowing arm, so no migration or ADR-0087 marker owed) is met. CI's verdict is Check Changeset (check-changeset-no-major.mjs): success on the head. Level: minor, widening. RIGHT.

③ Boundary flags

1. H2 falsified — the write lives in the protocol, with a second request key context. Answered, accepted. callData already hands _context.executionContext to the protocol's data methods, so one implementation serves every door and no door grows a write loop of its own. The second key exists at the protocol face only: the door sets it from the request's principal and never from the body, and the protocol refuses a context-less non-empty backfill, so the "as the caller" guarantee is enforced at the seam rather than assumed. The claim's file surface already placed the opt-in in protocol.ts and the door as a pass-through; the deviation is from the dispatch's mechanism hypothesis, not from the card's Scope.
2. Three generated artifacts outside the claim's listed files (api.json, protocol.mdx, the strictness-ledger count). Answered, accepted. A packages/spec/src/** schema change cannot land without them; each is a generator's output and each generator's gate is green on the head (named in ①). Nothing hand-authored rides in them.
3. The runtime-token / expression default refusal (an extra case beyond the card's "no defaultValue"). Answered, accepted. A NOW(), current_user or expression-envelope default resolves per insert against that insert's context; there is no one literal to stamp into rows written by other people at other times, and evaluating at publish time would stamp the publish instant or the publisher's identity into every existing row. Refusing by name at backfill.N is the narrower claim the runtime fully honours; the measured consumers (cloud#2656, the 可选补 0 card) are literals. For the objectui caller ([finding] The two artifact registrars' collection coverage is wrong in mirror-image ways: policies is a dead pointer in BOTH, and capabilities is declared but covered by only ONE #12894): offer 补默认值 only for a literal default.
4. The card's 12-row pin runs on a real ObjectQL engine over an in-memory store, not over HTTP on the SQLite dev backend. Answered, accepted. The Done-when reads "covered by a test that publishes a draft adding a boolean with defaultValue: false over 12 rows and reads 12 false" and the pin does exactly that through the real protocol and the real engine, with the receipt updated: 12. On the SQL driver ADD COLUMN carries the literal DEFAULT, so the 12-false assertion passes there with or without the backfill (measured on the PR, updated: 0); the in-memory store (no column default, like Turso remote, memory and MongoDB — cloud's case) is the harness where the assertion measures the feature, and the A1 ablation (write gated off, six cases red) confirms it does. The door half is pinned by the conformance file; the live HTTP run in the PR body is additional evidence, not a substitute.
5. H5, a failure midway: option A implemented — the field stops at its first failing row with updated so far, error and code; other fields still run; backfillApplied.success: false; the promotion is not undone; a warn log line. Answered, accepted. The promotion has committed and rows written stay written, so a rollback (C) would need machinery this card does not own; stopping every field (B) would hide the fields that could have landed. The declared shape carries every member of that answer, and the two pins (permission-denied caller; clearing hook) exercise both the updateManyData-reported and the thrown arms.
6. "As the caller" read as the caller's visibility: only rows the caller can read are filled; rows outside RLS/tenant scope stay empty and uncounted; updated says what was written, never that the table is complete. Answered, accepted — this is the ruling's literal semantics and the card's "object permissions and hooks fire as for a user edit". Option B (a system read of the remaining empty count) is the forbidden system path in read form. Consumers should expect a partial fill with a truthful count when a metadata manager's visibility is partial on an organization-partitioned object.
7. Turso-remote ADD COLUMN default asymmetry (columnDeclarationSQL emits no DEFAULT; the SQL driver's createColumn does). Out of scope, accepted as such; already recorded in remote-transport.ts's docblock and turso-remote-not-null.test.ts, not filed (carrier: none). The opt-in is the remedy on that driver, which is why it matters on cloud.
8. Reviewer's note, not blocking: the backfillApplied describe text ends "absent means nothing was asked". On the one exit where the request named fields but the batch did not publish (outcome: 'refused', published: []), the key is absent for the other reason. The preceding clause ("Present ONLY when the request named at least one field and the batch published") is exact and outcome/success disambiguate; the shape and the bytes are right. A wording tightening for a later pass.
9. Reviewer's note, not blocking: applyPublishBackfill locates the failing row as the first results[] element whose success is false, the discriminator locateBatchCause's own docblock marks wrong on the delete face ([finding] deleteManyData 的批量删除门仍无条件 success: true —— 打包集在批量里照样被报告为「已删除」,与 #19306 刚修的单记录门同形 #19412/A stopped or rolled-back bulk batch now names a causal row that did not fail, and calls the real error "unknown" — live on main since #19432 #19452). On the update face every non-success row carries errors[] (the fault, or NOT_ATTEMPTED appended after it) and the loop breaks at the first failure, so the first non-success in index order is the cause and the receipt's error/code are right. Using errors[] as the discriminator would be the more robust spelling.
10. Reviewer's note, answered: planPublishBackfill reads the draft with repo.get(ref, { state: 'draft' }) and no memberOption, where the two existing draft reads pass one. ITEM_KEY_DISCRIMINATORS holds email_template alone, so an object draft never carries a member and the omission is a no-op.
11. Reviewer's note, disclosed in the PR body under H4: between a page's $null read and its by-id write, a value a user stores in one of those rows would be overwritten with the default. The window is one page wide and the by-id updateData face has no conditional update; acceptable for an opt-in publish action, worth remembering if the face ever grows one.
12. Check-runs: at my first read two Test Core shards were in progress; at 07:31:29Z all 41 runs are complete, 36 success and 5 skipped by selector, none failed. Mergeable state reads blocked, as a draft awaiting this record and the queue should.
13. Tier: the diff touches a published schema under packages/spec/src/** and nothing under .claude/**; the schema face at CONTRACT_REVIEW_TIER is the right face. No agent approval is given or implied by this record.

Implemented-by: claude/issue-24253-publish-drafts-backfill
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T07:37Z · ACCEPT

Head: 08c87b8d0.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24253 and carries Clause-②: yes (widening) at a line start.
Scope	14 files (+905 / −6), claim 6245957326 as re-declared in 6247084004. publishPackageDrafts (protocol.ts, +340); the publish-drafts door (packages.ts, +8); packages.publishDrafts (client, +10/−1); PublishPackageDraftsResponseSchema (spec, +38/−1); three generated artifacts; three pin files; four changesets. Not governed (check-governed-merges.mjs --pr 24269: 0 of 14; +905/−6 is under the human-merge threshold).
Ruling	The card's Scope and Done when, verbatim, are met. The backfill is opt-in; nothing is written without the key. Every named entry is judged before anything is promoted: a field without a defaultValue is refused at backfill.N, loud and by name, and the draft stays pending. The write runs as the caller. A boolean with defaultValue: false over 12 rows reads 12 false, updated: 12, on the real engine over a store with no column default.
As the caller	Verified by the seat in the diff. The door adds backfill and context only when body.backfill is present, and context is the request's own _context.executionContext: body.context is never read. readPublishBackfillRequest refuses a non-empty backfill with no object context ("never written as the system"). The write is updateManyData with that context per row, so permissions, RLS and FLS, validation and hooks run as on the caller's own edit. The door's requireManageMetadata still guards the route.
No key	...(backfillApplied ? { backfillApplied } : {}): a caller without the key gets the same bytes as before (pinned by the door's absent-key list).
Review face	Schema (packages/spec/src/api/protocol.zod.ts). The CONTRACT_REVIEW_TIER record 6247208221 on this head is PASS. The declared backfillApplied matches the producer member for member on every exit.
Generated	authorable-surface/api.json (+1), references/api/protocol.mdx (+8) and the strictness-ledger count (442 → 444) are the generators' outputs, with their gates green. Declared to domain:spec on #6017.
Prose face	Four minor changesets, each with Clause-②: yes (widening). Each sentence matches the diff, including the SQL-driver note: there, ADD COLUMN already carries the literal DEFAULT, so a backfill reports updated: 0. No sentence is false.
Pins and ablation	Producer: 10 cases (the 12-row pin; no key; four refusals in one answer; an existing value kept; paging over 205 rows at limit 200; caller context at the CRUD seam and in the hook; a permission-denied caller; a clearing hook). Producer conformance +1, door conformance +4. Ablations A1–A4 each redden only their own cases. The one ablation the spec build refused is voided and not counted.
Gates	Dev union at 08c87b8d0: 116 derived, 116 run, 0 NOT MEASURED. Typecheck exit 0 for spec, metadata-protocol, runtime, client and objectql. check:generated 0.
CI	At this read: 41 check-runs, 36 success, 5 skipped, 0 failed. The skips are Console Pin Gate, the Dogfood matrix placeholder, Dogfood Verify CLI, Packed-tarball smoke and Temporal Conformance, each on the EXPECTED_SKIPS roster.

Disposition:

• open_questions[0] (H5, a failure midway): A, implemented. The field stops at its first failing row with its count so far and a named error and code; the other fields still run; success: false; the promotion stands.
• open_questions[1] (runtime-token and expression defaults): A, refused by name. There is no single value to stamp. For objectui#12894: offer 补默认值 only for a literal default.
• open_questions[2] (where the write runs): A, in the protocol. H2 was falsified by measurement, and the door is a pass-through.
• open_questions[3] (as the caller means the caller's visibility): A. updated counts what was written, never that the table is complete.
• deviations: accepted, re-declared in 6247084004: the context request key, the generated rows, and the producer pin in objectql.
• Named, nothing owed (record ③.8–③.11): two wording or robustness notes for a later pass, and a one-page read-to-write window disclosed in the PR body. The Turso-remote ADD COLUMN default asymmetry is out of scope; it is already recorded in remote-transport.ts.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). On merge this card closes, and objectui#12894 can start.

---

Generated by Claude Code