test(cli): ledger the four @objectstack/verify option-B losses (#15229)

Step 1 of the card's ordered pair: make the loss visible BEFORE fixing it, so
the fix has something to be checked against. The by-shape sweep (#15210) found
these four reads; neither `@objectstack/verify` site had a row in the #15004
acceptance pin, which is why the sweep and not the pin is what found them.

Four rows, all at B2 (`os verify` has one door — `loadConfig` — and never opens
a compiled artifact, so a B1 twin would measure a path no command drives):

  - `deriveCrudCases` · objects      — zero CRUD round-trip cases derived
  - `deriveCrudCases` · datasources  — the ADR-0015 double write gate
  - `declaredPositionNames` · positions — no persona for any declared position
  - `rlsProbePermissionSet` · objects   — an empty probe permission set

Every row calls a reader the package SHIPS; none re-implements one.

The datasource row needed a fixture member the zoo lacked: the datasource-by-
name map decides exactly one thing — whether a federated object's probe insert
clears ADR-0015's double opt-in — so watching it requires a federated object.
It is declared in the module package while the datasource that gates it is in
the App package, which makes the row a cross-package resolution. The control's
registry list grows by that object; the control itself is untouched.

RED, with only the rows added and the ledger lines absent:

  A subsystem lost a collection that the ledger does not carry — this is the
  failure #15004 exists to make loud.

    B2 · verify declaredPositionNames (one RLS persona per declared position) · positions
    B2 · verify deriveCrudCases (CRUD round-trip case derivation) · objects
    B2 · verify deriveCrudCases federated write gate (ADR-0015 double opt-in) · datasources
    B2 · verify rlsProbePermissionSet (RLS probe grants + owner narrowing) · objects

The BASELINE (additive shape) stayed green in that same run, so the red is a
discrimination and not a broken fixture. The four lines are then added to
OPTION_B_LOSSES, which is what this commit leaves in the tree; the next commit
fixes the readers and deletes them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

Author: claude

packages/cli/test/fixtures/option-b-collection-zoo.ts

@@ -79,6 +79,28 @@ export const ORDERS_PACKAGE_ID = 'com.example.probe.orders';
 export const PROBE_DATASOURCE = 'probe_primary';
 /** Relative to the project root — `resolve-project-database` anchors it there. */
 export const PROBE_DATASOURCE_FILE = '.objectstack/data/probe-primary.db';
+/**
+ * A FEDERATED datasource (ADR-0015), write gate OPEN.
+ *
+ * It is here for one reader: `deriveCrudCases` builds a datasource-by-name map
+ * and consults it for exactly ONE decision — whether a federated object's probe
+ * insert is allowed through the double write gate — so the only way to watch
+ * that map is to carry an external object whose gate depends on it. Declared in
+ * the App package while the object it gates lives in the module package, so the
+ * row watching it measures a CROSS-PACKAGE resolution and not a within-body
+ * read.
+ *
+ * ⚠️ The lean probe kernel builds no live driver for it, so every boot in this
+ * fixture's probe logs one `federated (external) object(s) are NOT bound to
+ * their remote table` ERROR. That is the truthful verdict for a federated
+ * object with no remote behind it; it touches no row here (nothing in this
+ * probe reads the object's data) and is expected output, not a fixture defect.
+ */
+export const PROBE_FEDERATED_DATASOURCE = 'probe_federated';
+/** Relative to the project root, same anchoring as the primary. */
+export const PROBE_FEDERATED_FILE = '.objectstack/data/probe-federated.db';
+/** The write-opted-in federated object the datasource gate above admits. */
+export const PROBE_FEDERATED_OBJECT = 'probe_federated_order';
 /** The `isDefault` permission set `appSecurityPluginOptions` must resolve. */
 export const PROBE_DEFAULT_PERMISSION_SET = 'probe_default_profile';
 export const PROBE_POSITION = 'probe_position';
@@ -137,6 +159,19 @@ const coreStack = (): ObjectStackDefinition =>
         config: { filename: PROBE_DATASOURCE_FILE },
         active: true,
       },
+      // The federated half — see `PROBE_FEDERATED_DATASOURCE`. `datasourceMapping`
+      // does NOT route to it (the project default stays `probe_primary`), so the
+      // only thing that reaches it is the object in the OTHER package binding to
+      // it by name.
+      {
+        name: PROBE_FEDERATED_DATASOURCE,
+        label: 'Probe Federated',
+        driver: 'sqlite',
+        config: { filename: PROBE_FEDERATED_FILE },
+        schemaMode: 'external',
+        external: { allowWrites: true },
+        active: true,
+      },
     ],
     datasourceMapping: [
       { datasource: PROBE_DATASOURCE, default: true },
@@ -199,6 +234,22 @@ const ordersStack = (): ObjectStackDefinition =>
           name: { name: 'name', type: 'text', label: 'Number', required: true },
         },
       },
+      // The FEDERATED object, bound to the datasource the OTHER package
+      // declares and write-opted-in on its own half of ADR-0015's double gate.
+      // A reader that resolves objects but not datasources still gets this one
+      // wrong — it reports the object `blocked` as read-only — which is what
+      // makes the two collections separately observable through one function.
+      {
+        name: PROBE_FEDERATED_OBJECT,
+        label: 'Probe Federated Order',
+        pluralLabel: 'Probe Federated Orders',
+        sharingModel: 'private',
+        datasource: PROBE_FEDERATED_DATASOURCE,
+        external: { remoteName: 'remote_orders', writable: true },
+        fields: {
+          name: { name: 'name', type: 'text', label: 'Number', required: true },
+        },
+      },
     ],
     actions: [
       {

packages/cli/test/fixtures/option-b-reader-probe.ts

@@ -62,6 +62,11 @@ import {
   resolveStandaloneDatabase,
 } from '@objectstack/runtime';
 import { appSecurityPluginOptions } from '@objectstack/plugin-security';
+import {
+  declaredPositionNames,
+  deriveCrudCases,
+  rlsProbePermissionSet,
+} from '@objectstack/verify';
 import { ObjectStackDefinitionSchema, normalizeStackInput } from '@objectstack/spec';
 
 // The lowering itself, not a copy of it — reached as SOURCE, by relative path,
@@ -72,6 +77,7 @@ import { lowerCallables } from '../../src/utils/lower-callables.js';
 
 import {
   PROBE_DEFAULT_PERMISSION_SET,
+  PROBE_FEDERATED_OBJECT,
   PROBE_FUNCTION,
   PROBE_FUNCTION_EFFECT,
 } from './option-b-collection-zoo.js';
@@ -369,6 +375,59 @@ export async function measureShape(project: unknown, projectRoot: string): Promi
     Object.keys(collectBundleFunctionEntries(project as never)).length,
   ));
 
+  // ── B2 · `os verify`'s readers (#15229) ──────────────────────────────────
+  //
+  // `os verify` has exactly ONE door — `loadConfig` (`verify.ts:92`) — and it
+  // never opens a compiled artifact, so these rows are B2 and there is
+  // deliberately no B1 twin. A B1 row here would measure a path no command
+  // drives, which reads as coverage this probe does not have.
+  //
+  // Every row calls a reader `@objectstack/verify` SHIPS, per this file's rule.
+  // What makes these the most expensive rows in the table is what the readers
+  // are FOR: `os verify` derives its whole proof set from the app's metadata,
+  // so a collection it cannot see is not a missing feature — it is a run that
+  // asserts nothing and still prints `✓ verify passed`.
+
+  const crudCases = deriveCrudCases(project) as Array<{ object: string; blocked?: string }>;
+  rows.push(countRow(
+    'B2 · verify deriveCrudCases (CRUD round-trip case derivation) · objects',
+    crudCases.length,
+  ));
+
+  // The datasource-by-name map, watched through the ONE decision it makes: the
+  // ADR-0015 double write gate. A reader that resolved `objects` but not
+  // `datasources` still fails this row — the case comes back `blocked` as
+  // "external read-only", which is a verifier silently skipping an object the
+  // app explicitly opted into writes for.
+  const federated = crudCases.find((c) => c.object === PROBE_FEDERATED_OBJECT);
+  rows.push(row(
+    'B2 · verify deriveCrudCases federated write gate (ADR-0015 double opt-in) · datasources',
+    federated ? (federated.blocked ?? 'derived — probe insert allowed') : 'no case derived at all',
+    !federated || Boolean(federated.blocked),
+  ));
+
+  rows.push(countRow(
+    'B2 · verify declaredPositionNames (one RLS persona per declared position) · positions',
+    declaredPositionNames(project).length,
+  ));
+
+  // The probe permission set is what makes an RLS run a PROBE at all: the
+  // object grants are what stop `checkObjectPermission` answering 403 before
+  // record scope is consulted, and the owner-scoped SELECT narrowing is what
+  // puts the persona outside the record scope. Empty on either half and every
+  // verdict the run prints is about neither.
+  const probeSet = rlsProbePermissionSet(project) as unknown as {
+    objects?: Record<string, unknown>;
+    rowLevelSecurity?: unknown[];
+  };
+  const grants = Object.keys(probeSet?.objects ?? {}).length;
+  const narrowings = (probeSet?.rowLevelSecurity ?? []).length;
+  rows.push(row(
+    'B2 · verify rlsProbePermissionSet (RLS probe grants + owner narrowing) · objects',
+    `${grants} granted object(s), ${narrowings} owner-scope rule(s)`,
+    grants === 0 || narrowings === 0,
+  ));
+
   // ── The booted AppPlugin, on BOTH entry paths ────────────────────────────
 
   const bootedFromArtifact = await bootAndRecord(bundle);

packages/cli/test/option-b-reader-acceptance.pin.test.ts

@@ -147,6 +147,10 @@ const OPTION_B_LOSSES: readonly string[] = [
   'B2 · runtime collectBundleActions over the from-source config · actions + objects[].actions',
   'B2 · runtime collectBundleFunctionEntries over the from-source config · functions',
   'B2 · runtime collectBundleHooks over the from-source config · hooks',
+  'B2 · verify declaredPositionNames (one RLS persona per declared position) · positions',
+  'B2 · verify deriveCrudCases (CRUD round-trip case derivation) · objects',
+  'B2 · verify deriveCrudCases federated write gate (ADR-0015 double opt-in) · datasources',
+  'B2 · verify rlsProbePermissionSet (RLS probe grants + owner narrowing) · objects',
   'B5 · resolve-project-database readConfigDeclaredDefault (project database tier) · datasourceMapping + datasources',
 ];
 
@@ -204,10 +208,19 @@ describe('#15004 — option-B acceptance pin: every subsystem must see its colle
     // control for every LOST row below: it proves the option-B fixture really
     // carries every definition under `packages[]`, so a zero is a reader losing
     // a collection and never a fixture that shipped an empty package.
-    expect(additive.registryObjectsFromArtifact).toEqual(['probe_account', 'probe_order']);
+    // `probe_federated_order` is the ADR-0015 federated object #15229 added to
+    // the zoo: `deriveCrudCases`'s datasource-by-name map decides exactly one
+    // thing — whether that object's probe insert clears the double write gate —
+    // so watching the map required carrying one. It registers like any other
+    // object, which is why it is in this control's list.
+    expect(additive.registryObjectsFromArtifact).toEqual(
+      ['probe_account', 'probe_federated_order', 'probe_order'],
+    );
     expect(optionB.registryObjectsFromArtifact).toEqual(additive.registryObjectsFromArtifact);
     expect(optionB.registryObjectsFromSource).toEqual(additive.registryObjectsFromSource);
-    expect(optionB.registryObjectsFromSource).toEqual(['probe_account', 'probe_order']);
+    expect(optionB.registryObjectsFromSource).toEqual(
+      ['probe_account', 'probe_federated_order', 'probe_order'],
+    );
   });
 
   // ── The baseline: green today, and it must stay green ────────────────────