[objectstack-fleet]

Requested by Elon · project thread

Fixes #30518
Refs #30054
Refs #30147

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:用 --members 把 findData 的方法体搬进 ProtocolDataCrudFacet,删掉它的门面例外登记;host-split.mjs 新增一条规则：实例方法若不是被调用、而是当作值读取，就拒绝搬移;getDiscovery 因此留在类上，登记行改挂 Facade codemods: retire the codemod-limit exception rows in the facade gate registry (protocol.ts, engine.ts, sql-driver.ts) #30147。
• 为什么改:首版也搬了 getDiscovery,但它用 typeof this.searchAll === 'function' 算出 capabilities.search;搬走后宿主条目是一个转发闭包，永远是函数，于是不能搜索的协议也会宣称可以搜索(rest 的 discovery-search-capability-agreement.test.ts 抓到)。
• 风险与回滚：纯搬移加一条拒搬规则，方法体逐字节不变，公开 index.d.ts / index.d.cts 前后字节相等;回滚即 revert 本 PR。
• 先看:host-split.mjs 新增的 4 行与 host-split.test.mjs 的两个用例;scripts/facade-delegation-registry.json 的 getDiscovery 行;protocol.query-transport-dialect.test.ts 的 4 行。
• 两分钟验证:node scripts/codemod-split-protocol.mjs --members --verify --base b6182249,预期 1 moved method(s) (findData)、退出码 0;node scripts/codemod-split-protocol.mjs --members getDiscovery 预期退出码 2,理由为 instance method \searchAll` read as a value`。
• 需要你做的：无，席位落地。

What changes

The move. findData (751 body lines) now delegates in one line to ProtocolDataCrudFacet; its signature and docblock stay on the class. protocol-host.ts gains the eight entries its body reads (searchAll and seven assert* field guards). protocol.ts goes from 13,775 to 13,007 lines and drops 28 import bindings only the moved body read. Written by node scripts/codemod-split-protocol.mjs --members findData --write, no hand edit after it. Its registry row leaves.

The rule. host-split.mjs refuses an instance method read other than as a callee (typeof this.m, const f = this.m): a host entry forwards a method through a closure, which is always a function, so the moved read would see the closure, not the instance's member. This mirrors the rule it already had for a private static method read as a value. host-split.test.mjs gains two refusal cases (the getDiscovery probe shape and a plain value read); both fail without the rule. Over the first pass's own --verify --base 48914fdc^, the rule changes exactly one member's verdict, getDiscovery.

getDiscovery stays. Its body sets capabilities.search from typeof this.searchAll === 'function' (#7541). The first version of this PR moved it, and packages/rest discovery-search-capability-agreement.test.ts went red (2 of 4): a protocol that shadows searchAll with undefined advertised search while /search answered 501. Its row returns to scripts/facade-delegation-registry.json under #30147 (the codemod-limit rows card), with that reason; the liveness/qa.json citation stays on protocol.ts#getDiscovery.

The path reader. protocol.query-transport-dialect.test.ts ("the fold names the spec export at the call site") read protocol.ts by path for findData's call site; it now reads protocol.ts and protocol-data-crud.ts joined.

The citations that moved with the body: packages/spec/liveness/query.json and docs/qa/platform-checklist/areas/search.json (protocol.ts#findData -> protocol-data-crud.ts#findData), and docs/qa/platform-checklist/areas/api-backend.json (protocol.ts#UNSUPPORTED_QUERY_PARAM -> protocol-data-crud.ts#UNSUPPORTED_QUERY_PARAM, a string token inside findData's body that check-platform-checklist.mjs reported as ABSENT SYMBOL).

Why

#30054 spelled the eight doors' return types (PR #30516) so their bodies could leave the facade; #30518 asked for the pass that moves them. PR #30687 added the pass and moved six; this PR moves findData and closes #30518 with getDiscovery a named codemod-limit exception carried by #30147.

Tests

• --members --verify --base b6182249 at 0df9bd1d: exit 0, 1 moved, checkMove 1/1. --members getDiscovery: exit 2 with the new reason.
• node scripts/codemod-split-protocol.mjs --self-test: 85 cases in 10 batteries pass. host-split.test.mjs: 40 pass; 2 fail with the rule removed (negative control).
• @objectstack/metadata-protocol at 0df9bd1d: vitest 320 files passed, 4 skipped; 22,487 tests passed, 26 skipped. typecheck exit 0.
• packages/rest discovery-search-capability-agreement.test.ts: 4/4 at 0df9bd1d (2/4 at 946d40b7). Full packages/rest locally: 12 failures, all _migrate-record-currency-codes rows of rest-write-route-hook-refusal-sentence.ledger.test.ts, the same 12 with this PR's src reverted (a local build artifact of feat(rest, client): a tenant-admin REST door for the record-currency code backfill #30809's packages; CI's verdict on the new head decides).
• check:liveness exit 0 and its tests (359) pass; check:platform-checklist exit 0; check-facade-delegation-only.mjs exit 0 (46 named exceptions).

Verification

Declaration files

pnpm --filter @objectstack/metadata-protocol build at base b6182249 and at 0df9bd1d: dist/index.d.ts and dist/index.d.cts cmp byte-equal (sha256 5cf3216a10daa533… on both sides).

dispatch-gates

node scripts/pm/dispatch-gates.mjs --commands at 0df9bd1d: 80 families derived, all 80 exit 0 (exit codes captured before any pipe). --ran: 80 derived, 80 run, 0 NOT-MEASURED, 0 UNRUN.

Changed lines

1,626 changed lines (+834 / −792, 11 files, changeset included), under the 3,000 budget.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/spec, touching 39 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/liveness/query.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

35 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 042efb7f12e935c913d1d6e323d2101827c78998.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/liveness/query.json) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: findData (4 routes)
• 1 anchor(s) matched too much of the corpus to be a work list: /data/:object (route, 76 pages)
• the SDK route bridge reached 63 of 222 client-bound route-ledger rows — the other 159 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 159: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 171 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 042efb7f12e935c913d1d6e323d2101827c78998 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cbd7280421322b41f0393224d7a1e08e740883a3 — the merge of head 0df9bd1d34653363a81ac162fa66916ec2dafde7 into base 042efb7f12e935c913d1d6e323d2101827c78998, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cbd7280421322b41f0393224d7a1e08e740883a3 && git checkout cbd7280421322b41f0393224d7a1e08e740883a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 042efb7f12e935c913d1d6e323d2101827c78998 0df9bd1d34653363a81ac162fa66916ec2dafde7 && git checkout -B drift-repro 042efb7f12e935c913d1d6e323d2101827c78998 && git merge --no-ff 0df9bd1d34653363a81ac162fa66916ec2dafde7

node scripts/docs-audit/affected-docs.mjs --json 042efb7f12e935c913d1d6e323d2101827c78998

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 042efb7f12e935c913d1d6e323d2101827c78998 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:devx#3 · os-elon-musk · session_016WV4cz3RTQjLh7hZBLzgtZ

席位核对 · ACCEPT · 0df9bd1d · 2026-11-06T07:45Z

Head-sha: 0df9bd1d34653363a81ac162fa66916ec2dafde7

• Scope: codemod-split-protocol: add a pass that moves a member of the landed protocol.ts facade into its facet (it refuses its own output, and the split no longer re-proves from its #29985 base) #30518 PR2 of 2. Moves findData into ProtocolDataCrudFacet (codemod --members findData --write, no hand edit after it) and drops its registry row. getDiscovery stays on the class: the first head moved it and packages/rest discovery-search-capability-agreement.test.ts went red (2/4), because a host entry forwards searchAll through a closure that is always a function, so capabilities.search would always read true (Discovery advertises capabilities.search = {enabled:false} while GET /api/v1/search serves 200 with real hits #7541). Seat ruled option A: host-split.mjs refuses an instance method read as a value (closed set), with two refusal cases in host-split.test.mjs that fail without the rule; getDiscovery's row is restored under Facade codemods: retire the codemod-limit exception rows in the facade gate registry (protocol.ts, engine.ts, sql-driver.ts) #30147 (codemod-limit rows), per ruling 6624345766 item 3.
• Read by the seat: the rule (4 lines) and its cases, the registry row and reason, the 7 new ProtocolHost entries (the assert* guards findData reads), the by-path reader in protocol.query-transport-dialect.test.ts, the three citation repoints (liveness/query.json, checklist search.json, api-backend.json), and the changeset (metadata-protocol + spec patch, both declaration lines). No findings.
• Shape: 11 files, +834/−792 (1,626 < 3,000). check-governed-merges --pr 30838: NOT governed. mergeable_state clean.
• Gates: check-runs on this head read by the seat: 58 success, 11 skipped, 0 failed or pending (Test Core 6/8 green, so the 12 local _migrate-record-currency-codes rows were a local build artifact). Dev: public index.d.ts / index.d.cts byte-equal vs base, --members --verify exit 0, check:liveness and check:platform-checklist exit 0, dispatch-gates 80/80 exit 0. Report 6679502015.
• Landing: non-governed; landing now under the maintainer's instruction to review and land per pm-dispatch (2026-11-06T03:51Z). Merging closes codemod-split-protocol: add a pass that moves a member of the landed protocol.ts facade into its facet (it refuses its own output, and the split no longer re-proves from its #29985 base) #30518; refactor: give the inferred-return-type public methods on the engine.ts and protocol.ts facades explicit return types (.d.ts unchanged), so the codemod can move their bodies #30054's Blocked-by note follows from the seat.