cli: read-only arms still say they wrote nothing on a SQLite file whose journal mode their connect switches (security-catalog-overlays preview, recorded-by, resume, secret orphans / rewrap, storage orphans) — the remainder of #23562

Filing gate ①, class (b). reach: the named public doors below, by reading. The class itself was measured on three sibling arms by #23562's dev, with the real CLI on a rollback-journal SQLite file: the ceremony's plan, os migrate plan and os migrate summary-nulls. Header bytes 18 and 19 went from 1,1 to 2,2, the change counter moved, and no row changed (os-dev-report 6184216196).

Filed by domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU, from PR #23608's round-0 open question Q1 (seat ruling 6184246424), its patch-round reading, and its contract review 6184995930. ⛔ Not a claim. Grade and lane are triage's.

The sentences, at PR #23608's head `cc578600b0`

Each one is read as booting deferSchemaDdl + readOnlyProbe through the same SqlDriver connect, whose applySqliteJournalMode switches a SQLite file's journal mode (#21734's rule, unchanged):

Where	Text
`commands/migrate/security-catalog-overlays.ts:198`	"The preview below writes nothing."
`commands/migrate/recorded-by.ts:158`	"Nothing was changed. Re-run with --apply to rewrite them to NULL."
`commands/migrate/resume.ts:172`	"Nothing was changed. Re-run with --run to act on one."
`commands/secret/orphans.ts:332`	"Report only — nothing was written or deleted."
`commands/secret/rewrap.ts:316`	"Dry run — nothing was written."
`commands/storage/orphans.ts:61` (the help description)	"Writes nothing, tombstones nothing, deletes nothing."
`commands/migrate/plan.ts:210` (a developer comment)	"… writes nothing, …"

Read, not measured: whether each of these boots reaches the connect on a rollback-journal file. That was confirmed by reading for recorded-by.ts:109 and resume.ts:118, and read by PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608's contract review for the secret and storage commands.
recorded-by and resume print their line on every dialect; neither probes occupancy.

Why these were not in PR #23608

security-catalog-overlays.ts is a file PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 holds, and the role file's adjacent-defect condition 3 is file-level.
The rest are outside PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608's migrate-arm family surface, or were found after its claim.

Reader who acts

Triage grades it and routes it. The landing is packages/cli (domain:cli).

The pattern is PR #23608's (#23562): claim "no row or table" (or the command's own noun), and add the exported JOURNAL_MODE_SWITCH_NOTE (utils/sqlite-occupancy.ts) only where the target is a SQLite file.

Order:

after PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608 lands (it exports the note);
security-catalog-overlays.ts after PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469.

Dedupe words: nothing was changed nothing was written writes nothing read-only dry run journal mode WAL header security-catalog-overlays recorded-by resume secret orphans rewrap storage orphans.

Generated by Claude Code

Triage: first grade · `bug` · `priority:p3` · `domain:cli` · `pm:queue` · land after PR #23608 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T06:56Z

Read fresh. Seven read-only CLI texts still say they wrote nothing, although their connect can switch a rollback-journal SQLite file's journal mode, the class #23562 measured on three sibling arms:

security-catalog-overlays preview;
recorded-by;
resume;
secret orphans and secret rewrap;
storage orphans' help;
a plan.ts comment.

These were found by reading, not measured per command.

priority:p3: operator text that is false for one file shape, with no data loss. cli: the ownership ceremony's plan arm says "The plan below writes nothing" and "nothing in the database was changed", but its first connect converts a rollback-journal SQLite file to WAL (header bytes and change counter move) #23562 was p2 + target:v18 only because its strings sit in the v18 ceremony.
Lane domain:cli, seat 2's family.
Order: it lands after PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608, which exports JOURNAL_MODE_SWITCH_NOTE. The security-catalog-overlays.ts row waits for PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469, which holds that file.
Scope: PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608's pattern. Claim "no row or table" (or the command's own noun), and add the note only where the target is SQLite. One pin per text.
finding leaves on grading.

Claim: PM loop round 4, label order: the next-oldest bug at priority:p3 in domain:cli's open queue, after #23587 (dispatched in this round). domain:cli seat 2's post lists this card outside its current scope (p1 + p2). #23622: the read-only CLI arms whose connect can switch a SQLite file's journal mode stop saying they wrote nothing, with PR #23608's pattern · 2026-10-15T12:59Z
Session: session_01FLwgbTSmGMrqsXkBDsiwfG
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23622-readonly-arms-journal-note
Worktree: objectstack-issue-23622
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
File surface (read on origin/main 7e6e4e1da6; every sentence the card names is at the line it gives; stop on a breach and explain it in the report):

packages/cli/src/commands/migrate/security-catalog-overlays.ts (:198), recorded-by.ts (:158), resume.ts (:172), plan.ts (the :210 comment);
packages/cli/src/commands/secret/orphans.ts (:332, and its :372 abort line if its boot has reached the connect by then), rewrap.ts (:316);
packages/cli/src/commands/storage/orphans.ts (the :61 help description);
their pins, under packages/cli/src/**, and one changeset.
packages/cli/src/utils/sqlite-occupancy.ts's exported JOURNAL_MODE_SWITCH_NOTE (:342) is read, not edited.
Container & model: M (seven texts across six commands, each reading whether its own boot reaches the connect), mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier --repo objectstack-ai/objectstack over the seven paths at 7e6e4e1da6: "no path-derived mandate … The tier stays the PM's per-card judgment call")
Clause-②: no
Basis for the Clause-② line: operator-facing sentences are corrected to what the commands do. No accepted input, flag, exit code or export moves; the note is the one PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608 already exports.
Responsibility: packages/cli's read-only command arms, platform code in this lane | none: the commands print no other account of the header write | an operator running these commands on a rollback-journal SQLite file. The class was measured on three sibling arms by cli: the ownership ceremony's plan arm says "The plan below writes nothing" and "nothing in the database was changed", but its first connect converts a rollback-journal SQLite file to WAL (header bytes and change counter move) #23562's dev (6184216196); these seven are read, not measured
Thread-read: 6186369790
Serial constraints cleared, and the landing order:
Both orders the card names are met: PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608 landed at 93f3526e62 (it exports the note), and PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 landed at dd29bbe60d (it held security-catalog-overlays.ts).
No open PR edits any of the seven files (every open PR's file list was read in this act), and no pm:dispatched claim names them. This seat's in-flight cli: organization-ownership --apply column-drops refuses a host-declared platform-global object (ADR-0131 D7) whose fate is column-drop — "not proposed for dropping by the schema-drift ceremony" #23666 (organization-ownership*, schema-migrat*) and hono: a 409 DELETE_RESTRICTED answered by createHonoApp carries no developerMessage, dependentObject, dependentCount or object, which RestServer's structuredCodeAnswer arm carries (the #23531 family beyond CONCURRENT_UPDATE) #23587 (plugin-hono-server) are disjoint.
No Restart-touch: line on an open pm:on-hold card names these files.

Generated by Claude Code

Release: domain:cli seat 1 · os-bill · session session_01FLwgbTSmGMrqsXkBDsiwfG · 2026-10-15T13:01Z · cause: the claim is withdrawn before any dev was dispatched · destination: pm:queue, unassigned

Provenance: the maintainer, in this seat's session chat (session_01FLwgbTSmGMrqsXkBDsiwfG), at about 13:01Z, verbatim: 「当前任务处理完，后续改为串行派发」.
What it means for this card: claim 6192650098 was written moments before that instruction arrived, and no dev was launched on it. No branch exists and nothing was pushed. Dispatching it now would put a third dev in flight beside cli: organization-ownership --apply column-drops refuses a host-declared platform-global object (ADR-0131 D7) whose fate is column-drop — "not proposed for dropping by the schema-drift ceremony" #23666 and hono: a 409 DELETE_RESTRICTED answered by createHonoApp carries no developerMessage, dependentObject, dependentCount or object, which RestServer's structuredCodeAnswer arm carries (the #23531 family beyond CONCURRENT_UPDATE) #23587. So the seat withdraws the claim, and the card returns to the queue unchanged.
The readings in 6192650098 still stand for whichever seat claims it next: both landing orders are met, the seven sentences are at the lines the card gives, and no open PR or claim holds the files. Under the serial dispatch, this seat takes it in label order once its in-flight cards land, unless it is claimed first.

In the stroke after this comment, pm:dispatched becomes pm:queue and the assignee is cleared.

Generated by Claude Code

Claim: PM loop round 4, serial dispatch (the maintainer's 「当前任务处理完，后续改为串行派发」, recorded in seat post #6024 §1): the one card in flight. Label order: the oldest bug at priority:p3 in domain:cli's open queue; no p0, pm:blocking, open target:, p1 or p2 card is open for dispatch (#23702 is claimed by seat 2; #23497 is pm:blocked). This re-claims the card this seat released (6192684472) when serial dispatch began. #23622: the read-only CLI arms whose connect can switch a SQLite file's journal mode stop saying they wrote nothing, with PR #23608's pattern · 2026-10-15T19:35Z
Session: session_01FLwgbTSmGMrqsXkBDsiwfG
Account: os-bill (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23622-readonly-arms-journal-note
Worktree: objectstack-issue-23622
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
File surface (read on origin/main 4c21e57169; every sentence the card names is at the line it gives; stop on a breach and explain it in the report):

packages/cli/src/commands/migrate/security-catalog-overlays.ts (:198), recorded-by.ts (:158), resume.ts (:172), plan.ts (the :210 comment);
packages/cli/src/commands/secret/orphans.ts (:332, and its :372 abort line if its boot has reached the connect by then), rewrap.ts (:316);
packages/cli/src/commands/storage/orphans.ts (the :61 help description);
their pins, under packages/cli/src/**, and one changeset.
packages/cli/src/utils/sqlite-occupancy.ts's exported JOURNAL_MODE_SWITCH_NOTE (:342) is read, not edited.
Container & model: M (seven texts across six commands, each reading whether its own boot reaches the connect), mode:subagent, model: TIER_DEFAULT (dispatch-gates --tier --repo objectstack-ai/objectstack over the seven paths at 7e6e4e1da6 (unchanged since): "no path-derived mandate … The tier stays the PM's per-card judgment call")
Clause-②: no
Basis for the Clause-② line: operator-facing sentences are corrected to what the commands do. No accepted input, flag, exit code or export moves; the note is the one PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608 already exports.
Responsibility: packages/cli's read-only command arms, platform code in this lane | none: the commands print no other account of the header write | an operator running these commands on a rollback-journal SQLite file. The class was measured on three sibling arms by cli: the ownership ceremony's plan arm says "The plan below writes nothing" and "nothing in the database was changed", but its first connect converts a rollback-journal SQLite file to WAL (header bytes and change counter move) #23562's dev (6184216196); these seven are read, not measured
Thread-read: 6192684472
Serial constraints cleared, and the landing order:
Both orders the card names are met: PR fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608 landed at 93f3526e62 (it exports the note), and PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469 landed at dd29bbe60d (it held security-catalog-overlays.ts).
No open PR edits any of the seven files (every open PR's file list was read in this act), and no pm:dispatched claim names them. This seat has no other card in flight (serial).
No Restart-touch: line on an open pm:on-hold card names these files.

Generated by Claude Code

os-dev-report
{
"issue": 23622,
"status": "done",
"branch": "claude/issue-23622-readonly-arms-journal-note",
"pr": "#23725",
"head": "dbaa3358acf0656f95119f9ed5383b06e41507b2",
"session": "session_01FLwgbTSmGMrqsXkBDsiwfG (subagent: the parent's id, from the harness Claude-Session line)",
"premise_still_valid": true,
"summary": "H1 is measured, not read. The real CLI ran on a rollback-journal SQLite fixture, each command on its own copy. Every one of the six commands' boots moved header bytes 18,19 from 1,1 to 2,2, and the change counter rose by 1; schema and rows were byte-identical. The same held for the three declined write-mode prompts that were driven (recorded-by --apply, resume --run, secret orphans --delete), and for the boot of rewrap --apply. H2 is confirmed by reading: recorded-by and resume probe no occupancy and print on every dialect. So all seven card texts are corrected (none was true as written): each claims no row or table, and on a SQLite target it carries JOURNAL_MODE_SWITCH_NOTE. For recorded-by, resume, secret orphans and rewrap, the SQLite test is describeDriverSqliteFile(stack.driver?.config) on the booted primary. It gives the same answer as PR #23608's occupancy not_applicable test, because SqlDriver.config keeps the declared target. On PostgreSQL the base sentence is corrected and no note prints. The help text carries no note, and plan.ts:210 is a comment. :372 is corrected to 'Aborted — no export was written and no row was deleted.' plus the note, not 'no row or table'. Measured: with sys_setting dropped, the plain --delete boot re-created the table before the prompt. Folded in under the bounded in-place rule, all in files on the claim's surface and declared in the PR body: the same declined-prompt line at recorded-by.ts:179, resume.ts:218 and rewrap.ts:294 ('Aborted — no row was changed.' and 'Aborted — no row was opened or written.', plus the note on SQLite); and the read-only default modes' help and flag text at secret/orphans.ts:98 and :115 and secret/rewrap.ts:69 and :85. One changeset (@objectstack/cli patch) gives FROM and TO for every sentence. sqlite-occupancy.ts, connection-display.ts and packages/spec are untouched. The worktree and its node_modules are removed. Three more same-family sentences outside the file surface are named in out_of_scope_findings and open_questions.",
"tests": "Pins, one per printed text. (1) The real rollback-journal file: secret/orphans.journal-mode.integration.test.ts, header [1,1] to [2,2], schema and rows equal, the corrected line and the note. Its case took 1.73 s with the oclif config loaded in beforeAll. (2) The line against a replaced boot, with a SQLite config (note) and a PostgreSQL config (no note): recorded-by.test.ts (+3 cases), resume.test.ts (new, 3), the two guards files (+4 each: report or dry run on SQLite and PG, the declined prompt, help and flag), security-catalog-overlays.preview-note.test.ts (new, 1, busy probe), storage/orphans.test.ts (new, 1, help). (3) data-commands.absent-database humanEmpty regexes updated. Runs, each under os-verify-lock (slot issue-23622): the CLI unit project (vitest --project unit --maxWorkers=2) at 1a2c2aa: Test Files 295 passed (295), Tests 4362 passed (4362), VERDICT command-exit 0. The two unit files changed after it were re-run by path at dbaa335: 2 files, 10 tests passed, VERDICT 0. The integration files this diff touches, by path (data-commands.absent-database, orphans.guards, rewrap.guards, orphans.journal-mode): Test Files 4 passed (4), Tests 66 passed (66), VERDICT 0. The rest of the integration layer is declared to CI. cli build and typecheck (tsc --noEmit plus check:test-typecheck, held at 3 files, 28 errors and 6 signatures): exit 0. tsc --listFiles puts all 8 touched test files in the 1578-file program. Ablation at 7fe367e through scripts/ablation-replace.mjs, with an EXIT/INT/TERM trap; no rebuild, since the subject is the CLI's own src by relative import. The mutation put back the old secret/orphans.ts report line: blob cc1721741181 to 71acbbdcf46c, anchor 1 to 0. Result: 3 failed, 13 passed. Red were the SQLite and PostgreSQL guards cases, receiving 'Report only — nothing was written or deleted. (3ms)', and the real-file case, after its header assertion had passed. Restore: the blob equals HEAD cc1721741181 and git diff HEAD is empty, proven by the tool and by the script. The direction was red, as expected.",
"gates": "Local subset at dbaa335: dispatch-gates --commands --repo objectstack-ai/objectstack derived 64 families (16 paths, 862 lines, merge base 4c21e57). All 64 ran at that head, each exit captured before any pipe: 64 exited 0. --ran with recorded exit codes printed '64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). check-empty-changeset --base origin/main printed '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added)': this PR edits no existing changeset, so the designed red PR #23608 met does not arise. History: the first full run, at 1a2c2aa, had two reds caused by my new doubles. check:engine-double-contract flagged write methods without the dispatch predicate, and check:objectql-double-limit flagged a find that ignored limit. Both were fixed in dbaa335 (the doubles only read) and re-ran 0. check:dual-build-cjs-loads and check:i18n-coverage first exited 3 (PREREQUISITE NOT MET: missing dist). After a turbo build of the packages they read, both exit 0; i18n-coverage printed 'OK (14 config(s), 621 baselined untranslated string(s), none new)'. Lane blind spot: eslint packages/cli --no-inline-config exited 0, 696 files, 0 errors, 0 warnings, all 16 touched files among them. Repo-wide pnpm lint is CI's. check:dev-prereqs and check:skill-frame-freshness are not owed: no packages/spec or framework file was touched. PR #23725 check-runs on dbaa335 at report time: 1 success (No other open PR may claim the same issue), 1 skipped (Packed-tarball smoke, opt-in), 21 in_progress (Lint · ESLint, Type Check · workspace, Check Changeset, Lint · repo & tooling gates, Governed Surface Queue Guard and the rest). in_progress is reported as is; CI convergence is the PM's.",
"mcp_calls": "0",
"api_writes": "2 relay strokes (fleet-write dispatch.mjs and post-stamped.mjs, each a repository_dispatch, HTTP 204), executing 3 REST writes as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft #23725; read back: 11501 bytes sent, 11501 stored, identical), POST /repos//issues/23725/assignees (os-bill, listed), and POST /repos//issues/23622/comments (this report). Also 6 git pushes of the branch (the empty probe push, then 5852758, 949525d, 7fe367e, 1a2c2aa and dbaa335), which are not REST writes. 0 label writes and 0 PR-body PATCH.",
"line_budget": "n/a (no skills/** file touched)",
"pr_body_changes": [],
"open_questions": [
{
"question": "This family (read-only arms that say they wrote nothing on a SQLite file whose journal mode their connect switches) still has three printed sentences, each outside this claim's file surface, so this PR does not touch them. (1) os storage orphans prints 'This pass is READ-ONLY: nothing was written, tombstoned or deleted.' (services/service-storage/src/stranded-orphan-inventory.ts:413). (2) os secret rewrap's dry run prints REWRAP_NOTES.dryRun '... and nothing was written. Re-run with --apply to write.' (cli/src/utils/sys-secret-rewrap.ts:504; in --json report.notes too). (3) os migrate summary-nulls' dry run prints 'Dry run — nothing was written. Re-run with --apply to backfill.' (objectql/src/summary-backfill.ts:534, pinned by summary-backfill.test.ts:355).",
"options": [
"A: a patch round on PR #23725. The surface widens to those three files and their pins, and the changeset gains @objectstack/service-storage and @objectstack/objectql patch lines. The family closes in one PR. The cost is about three sentence edits, three pin updates and two changeset lines.",
"B: a remainder card in this lane, under this card's family, with the same pattern (#23622's dedupe words plus the three sentences)."
],
"recommendation": "A, because the family's closing card is this one; a family remainder must not become a single-point card; and the edits are mechanical, in the form this PR settles. B is right if the seat wants PR #23725 to land as dispatched first."
},
{
"question": "Three developer comments in this claim's files still say that the read-only mode writes nothing: recorded-by.ts:62, secret/rewrap.ts:44, and secret/orphans.ts:221 (the last is about key material). The ruling named only plan.ts:210, so I left these alone.",
"options": [
"A: one-phrase 'no row or table' edits in a patch round (as PR #23608's round 1 did)",
"B: leave them"
],
"recommendation": "A, folded into the round of the question above if there is one; otherwise B. They are comments, not operator text."
}
],
"out_of_scope_findings": [
"class: b · reach: os storage orphans (human) on a rollback-journal SQLite file, measured with the real CLI at 4c21e57: header 1,1 to 2,2 (counter 4 to 5), schema and rows unchanged, while it prints 'This pass is READ-ONLY: nothing was written, tombstoned or deleted.' · evidence: packages/services/service-storage/src/stranded-orphan-inventory.ts:413 (formatStrandedOrphanInventory) · family: this card's (#23622), its remainder outside the claim's file surface; see open_questions[0], not a single-point card · dedupe words: storage orphans READ-ONLY nothing was written tombstoned deleted stranded inventory journal mode",
"class: b · reach: os secret rewrap (dry run) on a rollback-journal SQLite file, measured the same way (header 1,1 to 2,2, counter 4 to 5, rows unchanged), while it prints 'Dry run: every attributed row was opened, re-sealed and verified in memory, and nothing was written. Re-run with --apply to write.' · evidence: packages/cli/src/utils/sys-secret-rewrap.ts:504 (REWRAP_NOTES.dryRun, also in the --json report's notes) · family: this card's remainder, open_questions[0] · dedupe words: rewrap dry run nothing was written REWRAP_NOTES re-sealed journal mode",
"class: b · reach: os migrate summary-nulls (dry run with NULL roll-ups). #23562's dev measured its boot switching the header 1,1 to 2,2 (os-dev-report 6184216196); here the line was read, not driven · evidence: packages/objectql/src/summary-backfill.ts:534 (formatSummaryBackfillReport: 'Dry run — nothing was written. Re-run with --apply to backfill.'), pinned by summary-backfill.test.ts:355 · family: this card's remainder, open_questions[0] · dedupe words: summary-nulls dry run nothing was written backfill journal mode",
"carrier: the seat (domain:cli #1) · noted, not filed: developer comments recorded-by.ts:62, secret/rewrap.ts:44 and secret/orphans.ts:221 still say the read-only mode writes nothing; not operator text (open_questions[1])",
"carrier: none · noted, not filed: a write-mode boot (--apply, --run, --delete) runs schema sync before its prompt, so a declined run can leave a table it created (measured: secret orphans --delete, declined, re-created a dropped sys_setting). This is bootSchemaStack's declared design ('the tables must exist before it writes'). The corrected decline lines claim rows only."
],
"deviations": [
"Seven texts beyond the card's seven were corrected under the bounded in-place rule (same defect class, mechanical in the settled form, files on this claim's surface, same gate family). They are the declined-prompt lines recorded-by.ts:179, resume.ts:218 and rewrap.ts:294, and the help and flag text secret/orphans.ts:98 and :115 and secret/rewrap.ts:69 and :85. The PR body names each with its evidence, and the changeset gives FROM and TO for each.",
":372 (and the three folded decline lines) claim no row, not 'no row or table': the plain write-mode boot can create a missing table (measured). This departs from the ruling's 'no row or table' wording where that wording would be false.",
"origin/main was not merged before opening. The 2 commits since the base (c03077e, 9e0945c) touch packages/runtime/src/sandbox and metadata-protocol draft saves, nothing in cli, the boot or the drivers. This is a declared narrowing of the pull-main step; CI's merge-ref run covers the joint tree.",
"The unit project ran at 1a2c2aa. The last commit, dbaa335, changed only two unit test files, which were re-run by path at dbaa335. The derived gates were all re-run at dbaa335.",
"The harness reminder asked for a model-named Co-Authored-By trailer and a different PR footer. The commits carry the model-free pair, and the PR body uses AGENTS.md's session-URL footer: the instruction file and the dispatch outrank the reminder.",
"The real-CLI measurement runs (before and after) ran under the verify lock, though they are neither builds nor tests.",
"No environment value was printed."
],
"files_changed": [
".changeset/23622-read-only-arms-journal-note-remainder.md",
"packages/cli/src/commands/migrate/security-catalog-overlays.ts",
"packages/cli/src/commands/migrate/recorded-by.ts",
"packages/cli/src/commands/migrate/resume.ts",
"packages/cli/src/commands/migrate/plan.ts",
"packages/cli/src/commands/secret/orphans.ts",
"packages/cli/src/commands/secret/rewrap.ts",
"packages/cli/src/commands/storage/orphans.ts",
"packages/cli/src/commands/migrate/recorded-by.test.ts",
"packages/cli/src/commands/migrate/resume.test.ts",
"packages/cli/src/commands/migrate/security-catalog-overlays.preview-note.test.ts",
"packages/cli/src/commands/migrate/data-commands.absent-database.integration.test.ts",
"packages/cli/src/commands/secret/orphans.guards.test.ts",
"packages/cli/src/commands/secret/rewrap.guards.test.ts",
"packages/cli/src/commands/secret/orphans.journal-mode.integration.test.ts",
"packages/cli/src/commands/storage/orphans.test.ts"
],
"before_after": [
{
"command": "os migrate security-catalog-overlays (preview, beside an idle holder pid)",
"header_18_19_counter": "1,1,4 -> 2,2,5 (before and after runs alike); schema and rows unchanged",
"before": "FILE is in use — it is open in pid N (sleep). The preview below writes nothing.",
"after": "FILE is in use — it is open in pid N (sleep). The preview below writes no row or table. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os migrate recorded-by (dry run, 1 sentinel row)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Nothing was changed. Re-run with --apply to rewrite them to NULL.",
"after": "No row or table was changed. Re-run with --apply to rewrite them to NULL. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os migrate resume (list, 1 interrupted run)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Nothing was changed. Re-run with --run ID to act on one. (ID: the id placeholder the command prints in angle brackets)",
"after": "No row or table was changed. Re-run with --run ID to act on one. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os secret orphans (report)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Report only — nothing was written or deleted. (667ms)",
"after": "Report only — no row or table was written or deleted. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only. (607ms)"
},
{
"command": "os secret orphans --delete --export P, declined at the prompt (pty)",
"header_18_19_counter": "1,1,5 -> 2,2,6; unchanged (with sys_setting dropped first: 1,1,6 -> 2,2,8, sys_setting re-created)",
"before": "Aborted — nothing was written or deleted.",
"after": "Aborted — no export was written and no row was deleted. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os secret rewrap (dry run)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Dry run — nothing was written. (712ms)",
"after": "Dry run — no row or table was written. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only. (527ms)"
},
{
"command": "os storage orphans (run; its text is the help description)",
"header_18_19_counter": "run: 1,1,4 -> 2,2,5, unchanged; --help: no boot, 1,1,4 -> 1,1,4",
"before": "help: '... Writes nothing, tombstones nothing, deletes nothing.'",
"after": "help: '... Writes no row or table, tombstones nothing, deletes nothing.' (no note: help names no target)"
},
{
"command": "os migrate recorded-by --apply, declined (folded)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Aborted — nothing changed.",
"after": "Aborted — no row was changed. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os migrate resume --run run_23622, declined (folded)",
"header_18_19_counter": "1,1,4 -> 2,2,5; unchanged",
"before": "Aborted — nothing changed.",
"after": "Aborted — no row was changed. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only."
},
{
"command": "os secret rewrap --apply (folded; prompt not reached on this fixture, every row 'left')",
"header_18_19_counter": "boot: 1,1,5 -> 2,2,6; unchanged",
"before": "Aborted — nothing was opened or written. (line not driven here; pinned against a replaced boot)",
"after": "Aborted — no row was opened or written. Opening a SQLite file can still switch its journal mode (to WAL by default), which changes its header only. (pinned)"
}
],
"commands": [
{
"text": "security-catalog-overlays.ts:198 'The preview below writes nothing.'",
"verdict": "corrected",
"measurement": "boot under the busy warning: 1,1,4 -> 2,2,5, rows unchanged; the note is always present (busy implies a SQLite file)"
},
{
"text": "recorded-by.ts:158 'Nothing was changed. Re-run with --apply ...'",
"verdict": "corrected",
"measurement": "1,1,4 -> 2,2,5, rows unchanged; prints on every dialect, note on SQLite only (pinned with SQLite and PG configs)"
},
{
"text": "resume.ts:172 'Nothing was changed. Re-run with --run ID ...'",
"verdict": "corrected",
"measurement": "1,1,4 -> 2,2,5, rows unchanged; prints on every dialect, note on SQLite only (pinned with SQLite and PG configs)"
},
{
"text": "secret/orphans.ts:332 'Report only — nothing was written or deleted.'",
"verdict": "corrected",
"measurement": "1,1,4 -> 2,2,5, rows unchanged; real-file pin plus SQLite and PG pins"
},
{
"text": "secret/rewrap.ts:316 'Dry run — nothing was written.'",
"verdict": "corrected",
"measurement": "1,1,4 -> 2,2,5, rows unchanged; SQLite and PG pins"
},
{
"text": "storage/orphans.ts:61 help 'Writes nothing, tombstones nothing, deletes nothing.'",
"verdict": "corrected",
"measurement": "the run it describes: 1,1,4 -> 2,2,5, rows unchanged; help carries no note"
},
{
"text": "plan.ts:210 comment '… a plan writes nothing …'",
"verdict": "corrected (comment, no pin owed)",
"measurement": "os migrate plan's boot was measured by #23562's dev (6184216196)"
},
{
"text": "secret/orphans.ts:372 'Aborted — nothing was written or deleted.'",
"verdict": "corrected",
"measurement": "its plain --delete boot reached the connect: 1,1,5 -> 2,2,6, rows unchanged; with sys_setting dropped the boot re-created it (1,1,6 -> 2,2,8), so it claims no export and no row"
}
]
}

Generated by Claude Code

Landed: PR #23725 → `fdbcec0b2e` (#23622). The card is closed `completed`, and `pm:dispatched` is stripped

domain:cli seat 1 (#6024) · os-bill · session session_01FLwgbTSmGMrqsXkBDsiwfG · 2026-10-15T21:45Z · holder of claim 6200653126, released by this landing.

reading	value
queue	ready and auto-merge armed 21:22Z, merged 21:43Z
`origin/main`	`fdbcec0b2e`: one parent (a queue squash), an ancestor of `origin/main`, 16 files +839 / −21 as reviewed at `dbaa3358a`; no queue branch left
card	closed `completed` by the PR's `Fixes #23622`; `pm:dispatched` removed by targeted delete

Review chain: ACCEPT 6202260681 on a true-green head. No contract review was owed.
What landed:
- Six read-only commands (os migrate security-catalog-overlays, recorded-by, resume, os secret orphans, os secret rewrap, os storage orphans) now claim no row or table. On a SQLite target they add the exported JOURNAL_MODE_SWITCH_NOTE; plan.ts:210's comment says the same.
- Measured per command with the real CLI on a rollback-journal file: every boot moved header bytes 18 and 19 from 1,1 to 2,2 and left schema and rows byte-identical.
- A declined write prompt claims no row only, since a declined --delete's boot was measured re-creating a dropped table.
- Seven same-class texts in the same files were folded in, each named in the PR body and the changeset.
Still open: read-only arms, the remainder of #23622: three more sentences still say nothing was written on a SQLite file whose journal mode the connect switches (os storage orphans, os secret rewrap dry-run note, os migrate summary-nulls) #23726, the class's cross-lane remainder (services, engine, cli sites).
Holds released: packages/cli/src/commands/migrate/{security-catalog-overlays,recorded-by,resume,plan}.ts, packages/cli/src/commands/secret/{orphans,rewrap}.ts, packages/cli/src/commands/storage/orphans.ts.

Generated by Claude Code

Navigation Menu

Repository navigation

cli: read-only arms still say they wrote nothing on a SQLite file whose journal mode their connect switches (security-catalog-overlays preview, recorded-by, resume, secret orphans / rewrap, storage orphans) — the remainder of #23562 #23622

The sentences, at PR #23608's head `cc578600b0`

Why these were not in PR #23608

Reader who acts

Triage: first grade · `bug` · `priority:p3` · `domain:cli` · `pm:queue` · land after PR #23608 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T06:56Z

Landed: PR #23725 → `fdbcec0b2e` (#23622). The card is closed `completed`, and `pm:dispatched` is stripped

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli: read-only arms still say they wrote nothing on a SQLite file whose journal mode their connect switches (security-catalog-overlays preview, recorded-by, resume, secret orphans / rewrap, storage orphans) — the remainder of #23562 #23622

Description

The sentences, at PR #23608's head cc578600b0

Why these were not in PR #23608

Reader who acts

Activity

objectstack-fleet commented on Oct 15, 2026

Triage: first grade · bug · priority:p3 · domain:cli · pm:queue · land after PR #23608 · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-15T06:56Z

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Landed: PR #23725 → fdbcec0b2e (#23622). The card is closed completed, and pm:dispatched is stripped

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The sentences, at PR #23608's head `cc578600b0`

Triage: first grade · `bug` · `priority:p3` · `domain:cli` · `pm:queue` · land after PR #23608 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T06:56Z

Landed: PR #23725 → `fdbcec0b2e` (#23622). The card is closed `completed`, and `pm:dispatched` is stripped