driver-memory census in `undeclared-field-write-driver-split.integration.test.ts` is stale — a second `packages/runtime` test consumer (#6468) is outside #5704's "in this one place" ruling

[os-zhuang]

Observation-class finding, surfaced while migrating auth-contains-filter.test.ts off driver-memory (#5893). Nothing a user hits — this is a bookkeeping invariant of the driver-memory retirement programme that has silently expired. Filed unassigned for PM triage; not fixed in #5893's PR (out of its file surface, and the disposition needs a ruling rather than an edit).

What is stale

packages/runtime/src/sandbox/undeclared-field-write-driver-split.integration.test.ts opens with a load-bearing census sentence:

@objectstack/driver-memory is imported here ON PURPOSE, and this is the only PERMANENT test consumer of it in the repository.

and closes the same block with the mechanism that sentence exists to serve:

#5704/#5784 renamed them all to makeStubDriver, precisely so that grepping for the driver lands here, and only here.

That is the verification handle the retirement programme uses: grep the declarations, land on exactly one ruled file, and anything else is a new arrival to dispose of. The count is no longer true.

Evidence (on origin/main, e6025e9)

$ git grep -n "from '@objectstack/driver-memory'" -- '*.ts' | grep -v node_modules
packages/runtime/src/sandbox/undeclared-field-write-driver-split.integration.test.ts:107
packages/runtime/src/autonumber-seed-cross-side-parity.integration.test.ts:35
examples/embed-objectql/src/index.ts:17

The second line is the finding. packages/runtime/src/autonumber-seed-cross-side-parity.integration.test.ts arrived with #6468 (PR #6553, fix(objectql,driver-sql): 播种解析按声明的 suffix 定位计数器) — after #5704's survey and after #5830's follow-up — and it imports InMemoryDriver for a reason that reads exactly as permanent as the ruled file's:

The engine half runs on the REAL InMemoryDriver (supports = {}, so the engine's fallback owns the counter — the shape memory/mongo deployments run) and the driver half on a REAL SqlDriver over better-sqlite3, each holding the same fixture rows.

i.e. it is the same shape of justification #5704 Q2=B accepted for the driver-split file — a cross-family divergence/convergence pin that structurally needs a schemaless arm — but it has never been through that ruling, carries no ⚠️-block saying so, and is not named anywhere in the census it invalidates.

(examples/embed-objectql/src/index.ts is a published example demonstrating the driver, not a test consumer; packages/runtime, packages/cli, packages/services/service-datasource, packages/plugins/plugin-dev and examples/embed-objectql declare the dependency in package.json. Those are a separate axis and not what this finding is about.)

Why it matters even though it is "just a comment"

The census IS the enforcement. There is no gate counting driver-memory consumers — #5704's design deliberately made the grep authoritative by renaming every look-alike stub to makeStubDriver. So the comment is the only thing telling the next agent what a grep hit means. As written today it tells them "one hit, and it is ruled" while the tree has two, one of them unruled. Two concrete ways that misleads:

1. An agent verifying "driver-memory retirement is complete" greps, sees two hits, reads the ruled file's "only here", and concludes the other hit is a migration leftover to delete — deleting the schemaless arm of 自增号格式带「序号槽之后的后缀」时,播种解析读错数字段:引擎读成年份(2026),driver-sql 读成拼接串(12026),两侧还互不一致 #6468's convergence assertion, which would leave the autonumber parity test asserting SQL against SQL.
2. The opposite error: an agent takes the second file as implicitly covered by driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 and stops looking, so a third arrival never gets disposed of either. [finding] #5704 收口后仓内新增一个 driver-memory 测试消费者:plugin-auth/auth-contains-filter.test.ts(#5710 pin 测试,与 #5704 程序不变量的张力,请分诊裁处置) #5830 → auth-contains-filter.test.ts 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单 #5893 is the worked example of what the census is supposed to catch; it worked because the ruled file's comment was updated by hand each time, which is exactly the step that did not happen for 自增号格式带「序号槽之后的后缀」时,播种解析读错数字段:引擎读成年份(2026),driver-sql 读成拼接串(12026),两侧还互不一致 #6468.

#5893's PR corrects the ruled file's own sentence so it no longer claims a repository-wide count it cannot defend (it now claims a ruling about itself, and points here). That stops the comment lying; it does not decide the second file's status.

The decision this needs

For packages/runtime/src/autonumber-seed-cross-side-parity.integration.test.ts:

• A. Rule it permanent too, the same way driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 Q2=B ruled the driver-split file — give it its own ⚠️ block stating why the schemaless arm is structural (the engine's supports = {} fallback path has no SQL equivalent), and restate the census as "two ruled consumers".
• B. Migrate it, if the engine-fallback arm can be witnessed without driver-memory — needs measuring first, exactly as [finding] #5704 收口后仓内新增一个 driver-memory 测试消费者:plugin-auth/auth-contains-filter.test.ts(#5710 pin 测试,与 #5704 程序不变量的张力,请分诊裁处置) #5830 measured before deferring auth-contains-filter.test.ts 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单 #5893: a backend swap that cannot distinguish the defect produces an always-green pin, which is the failure mode this family has already paid for once.
• C. Replace the census with a gate, so the invariant stops depending on hand-edited prose: a check:* that enumerates @objectstack/driver-memory declarations (imports + package.json deps) against a small ledger of ruled entries, failing on any unledgered arrival. This is the option that makes the next 自增号格式带「序号槽之后的后缀」时,播种解析读错数字段:引擎读成年份(2026),driver-sql 读成拼接串(12026),两侧还互不一致 #6468 impossible to miss, and it is the same ratchet shape the repo already uses for type-check coverage and query-options erasure.

Recommendation, for whoever triages: A or B on the file (measure before choosing, per #5830's precedent), and C independently — the underlying defect here is not that someone forgot to edit a comment, it is that a programme-critical invariant was left in a comment where nothing can hold it to the tree.

Links

#5704 (the ruling + the makeStubDriver rename), #5499 (the driver-memory investment freeze), #5830 / PR #5880 (identity-lane migration, half), #5893 (the other half — where this was found), #6468 / PR #6553 (the unruled arrival).

[qq9340100]

Findings triage round (2026-08-08, maintainer-directed sweep): hold confirmed (finding stays).

Half the card is already fixed on main — PR #6665 rewrote the census sentence to point here — and what remains is exactly the unmade A/B/C disposition on the second driver-memory consumer (the autonumber cross-side parity test, which carries no ruling block), inside the #5499 freeze area. Exit: a #5704-style measure-before-choose disposition ruling; option A (pin-annotate) is the freeze-compatible shape. A future agent completing the retirement must not delete the schemaless arm of the #6468 parity test.

---

Generated by Claude Code

[qq9340100]

Maintainer ruling (2026-08-08, session review of the held-findings backlog): Option A + Option C, one PR; Option B rejected.

• A — rule the second consumer permanent. packages/runtime/src/autonumber-seed-cross-side-parity.integration.test.ts inherits the driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 Q2=B ruling: its schemaless arm is structural for the same reason the driver-split file's is (the engine's supports = {} fallback path has no SQL equivalent — the cross-family convergence assertion needs it). Give it its own ruling block stating this, and restate the census as two ruled consumers.
• B rejected: migrating would spend measurement effort inside the [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 freeze area for zero user-visible payoff, and this family has already paid once for an always-green pin after a backend swap.
• C — add the gate. This card is itself the proof that a prose census fails (the hand-edit step was skipped exactly once and the invariant silently expired). Add a small check:* script that enumerates @objectstack/driver-memory declarations (imports and package.json deps) against a two-entry ledger of ruled consumers, failing on any unledgered arrival. This polices the retirement programme rather than investing in the driver, so it is freeze-compatible.

Promoting finding to dispatch this round. Note for the dev: PR #6665 already rewrote the ruled file's census sentence to point here — work from current origin/main, do not restore the old "only here" claim.

---

Generated by Claude Code

[qq9340100]

Claim: PM loop round 1 (maintainer-directed findings execution, 2026-08-08)
Session: session_01K94yzy5CVgC2JtrqYAuDk2
Branch: claude/issue-6664-driver-memory-census
Worktree: objectstack-issue-6664
Domain: domain:drivers
File surface: packages/runtime/src/sandbox/undeclared-field-write-driver-split.integration.test.ts, packages/runtime/src/autonumber-seed-cross-side-parity.integration.test.ts, scripts/ (new check script), root package.json (script wiring), .github/workflows/lint.yml if gate wiring requires it
Serial constraints cleared: PR #6665 (census-sentence rewrite, merged today) touched the ruled file — dev is instructed to work from current origin/main. No in-flight claim or open PR found on either test file or the census surface.

---

Generated by Claude Code

[qq9340100]

ACCEPT — PR #6693 reviewed and moving to the merge queue.

What shipped, against the 2026-08-08 ruling (Option A + C, B rejected):

• A: autonumber-seed-cross-side-parity.integration.test.ts now carries its own ruling block inheriting driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704 Q2=B (the schemaless arm is structural — supports = {} hands the counter to the engine's fallback, and a sqlite swap would collapse both arms into one implementation, the always-green shape this family already paid for). The driver-split file's census is restated as two ruled consumers, building on the post-test(plugin-auth): migrate the contains witness to sqlite, now that $regex is refused (#5893) #6665 wording. One inherited inaccuracy corrected: the runtime declaration is a dependencies entry, not devDep, and the ledger records what is actually there.
• C: the census is now scripts/driver-memory-census.ledger.json read by pnpm check:driver-memory-census (AST-based, covers static/dynamic/require/vi.mock bindings plus package.json declarations), wired into lint.yml's ESLint job, with five named invariants; the CENSUS invariant makes each ruled file state the ledger-derived count verbatim, so the sentence and the set can no longer drift apart. Reverse-verified in both directions (pre-ruling-block red ×4 exactly as predicted; probe arrival red on LEDGERED; green after removal).

Review checks: changed files exactly match the claimed surface (6 files, no releases/ edits); ESLint and TypeScript Type Check job conclusions personally verified success; 37/37 check runs no failures; skip-changeset correct for a tests+tooling-only diff; PM assumption 3 (no generated-artifact churn) verified by the dev with check:generated all-10-up-to-date.

---

Generated by Claude Code