`auth-contains-filter.test.ts` 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单

[baozhoutao]

Blocked-by: #5702

由 #5830 的裁决 C 产生(identity 车道 PM,session_01JwwiU9bjhwy2SWj13ho8uv,2026-08-06;域标签沿 #5830 分诊座位的同文件锚定)。#5830 已随 PR #5880 关闭:两个 driver-memory 临时测试消费者一个已迁(auth-where-operator-coverage.test.ts),本单承载未迁的那个及其到期条件。

为什么现在不能迁(实测,PR #5880 留档)

packages/plugins/plugin-auth/src/auth-contains-filter.test.ts 是 #5710(contains → 裸 $regex 翻转)的 pin。driver-sql 把 $regex 经 case '$regex': fallthrough 与 $contains 同走 applyContainsLike(sql-driver.ts:6505-6512),SQL 后端对两者逐格同答:

• 复现缺陷(适配器改回裸 $regex)后:memory 见证 3 条行为面 pin 红;同一行为面搬到 sqlite 全绿。
• 驱动层直测:$regex a.b → memory ["a.b","axb"] / sqlite ["a.b"];$regex ( → memory THROW / sqlite ["x(y"]。

迁过去的 pin 会「因为分辨不出任何东西所以恒绿」—— 恒绿 pin 是最危险的资产:出现在覆盖率里、看起来「有测试」,对它声称守护的缺陷完全失明。

到期条件(解锁即执行)

#5702 范围 1(driver 侧 $regex 拒收单点化)落地后,SQL 臂对 $regex 按名拒收(算子不在 allowlist)—— 缺陷可被 SQL 后端以拒收方式见证(红,且理由比原来更好)。届时:

1. 照抄 PR test(plugin-auth): where-operator 覆盖测试迁到 sqlite :memory: 见证;contains pin 实测不可迁,留证上报 (#5830) #5880 的 harness(SqlDriver + better-sqlite3 :memory: + initObjects 真 DDL)迁移本文件;
2. 摘除 plugin-auth 的 @objectstack/driver-memory devDep(届时应为零消费)+ lockfile 涟漪;
3. 修订 undeclared-field-write-driver-split.integration.test.ts 的注释(其 [[finding] #5704 收口后仓内新增一个 driver-memory 测试消费者:plugin-auth/auth-contains-filter.test.ts(#5710 pin 测试,与 #5704 程序不变量的张力,请分诊裁处置) #5830] 段已预写了这一步),恢复「仅 driver-split 一处」的字面为真;
4. 反向验证:缺陷复现在新后端上必须红(拒收路径),照 test(plugin-auth): where-operator 覆盖测试迁到 sqlite :memory: 见证;contains pin 实测不可迁,留证上报 (#5830) #5880 的双向反验打法。

关联

#5830(裁决现场)、PR #5880(已迁一半 + 实测数据)、#5710/#5812(pin 的来源)、#5704(程序)、#5702(到期依赖,其正文/评论已有本别名为死产者代码的实测记录)。

[os-zhuang]

Unblock + Claim (identity seat, PM loop round 1).

Unblock evidence — the expiry condition ("SQL arm refuses $regex by name") is now met: #5702 closed completed via PR #6549 (verified merged: true, 2026-08-08 06:43Z). The refusal lands in driver-sql's emitter with INVALID_FILTER code + status 400 asserted (PR #6549 body, section "必须产出的证据"), so the defect this pin guards can now be witnessed on the sqlite backend via the refusal path — red, with a better reason than before, exactly as this card's expiry clause predicted. pm:blocked → pm:queue, claimed in the same stroke.

Claim: PM loop round 1 (identity seat)
Session: session_01BM1tNf5U3nEbHKR4fo5qVQ
Branch: claude/issue-5893-auth-contains-sqlite-witness
Worktree: objectstack-issue-5893
Domain: domain:identity
File surface: packages/plugins/plugin-auth/src/auth-contains-filter.test.ts (harness migration), packages/plugins/plugin-auth/package.json (drop @objectstack/driver-memory devDep), pnpm-lock.yaml (ripple), packages/plugins/plugin-auth/src/undeclared-field-write-driver-split.integration.test.ts (comment revision only). Stop on breach; explain in the report.
Serial constraints cleared: no in-flight PR/branch touches plugin-auth (verified against open PRs and today's origin/main log — last plugin-auth commit is #6534, docs-link only); disjoint from this round's other in-flight dispatch (#5492+#5491, plugin-security only); real driver-memory consumers in plugin-auth verified on origin/main: only the test file being migrated + the devDep (remaining grep hits are prose comments, which stay).
Container class: M — mode:subagent (shared container), verification radius plugin-auth + lockfile.

---

Generated by Claude Code

[os-zhuang]

ACCEPT — PR #6665 (identity seat, round 1 review).

What shipped, verified against the diff and CI rather than the report's claims:

1. Harness migration exactly per the expiry clause: auth-contains-filter.test.ts moved to SqlDriver + better-sqlite3 :memory: + real DDL (initObjects), the PR test(plugin-auth): where-operator 覆盖测试迁到 sqlite :memory: 见证;contains pin 实测不可迁,留证上报 (#5830) #5880 harness. The four behavioural pins answer value-for-value what memory answered — the fixture lost nothing.
2. Reverse verification, direction predicted before running: defect restored ⇒ 5 red via the refusal path (retiredFilterOperatorError → INVALID_FILTER / 400), exactly the "red, with a better reason" the expiry clause predicted. The dev's honest note that the new face-3 stays green under this mutation — and why that is correct — is the kind of reporting this lane wants.
3. Face 3 (discrimination) is the load-bearing addition: it pins "this backend refuses $regex (code AND status) while still answering $contains" — without it the migrated pins would silently become the always-green asset [finding] #5704 收口后仓内新增一个 driver-memory 测试消费者:plugin-auth/auth-contains-filter.test.ts(#5710 pin 测试,与 #5704 程序不变量的张力,请分诊裁处置) #5830 refused to create if driver-sql ever re-aliases the operator.
4. devDep removal + lockfile ripple clean (Validate Package Dependencies job: success; --frozen-lockfile passes).
5. Census correction handled honestly: the issue's step-3 goal (restore "only here" to literal truth) was measured to be already unachievable — 自增号格式带「序号槽之后的后缀」时,播种解析读错数字段:引擎读成年份(2026),driver-sql 读成拼接串(12026),两侧还互不一致 #6468 added a second runtime consumer outside driver-memory 测试面替代:项目内测试后端迁到 sqlite :memory:(#5499 重启条件 · memory 半边,维护者 2026-08-06 立项) #5704's ruling. Rather than write a sentence known to be false, the comment now claims a ruling about itself and the census defect is filed as driver-memory census in undeclared-field-write-driver-split.integration.test.ts is stale — a second packages/runtime test consumer (#6468) is outside #5704's "in this one place" ruling #6664 (finding, unassigned, three dispositions + recommendation — awaiting triage; it is domain:drivers territory). This is the acceptance criterion being falsified with evidence, which is a good run, not a deviation.
6. Scope deviation flagged (runtime comment file lives outside the claim's literal surface): comments-only, named by the issue's own step 3 — accepted.

CI verified per-job: ESLint success, TypeScript Type Check success, Test Core 3/3 success, Validate Package Dependencies success. skip-changeset applied (tests + devDep only — correct call, rationale in the PR body). Proceeding to ready + merge queue.

---

Generated by Claude Code