[objectstack-fleet]

Requested by Elon · project thread

Fixes #27750

维护者速读

• 改了什么：管理员修改一个 Setup 创建的托管数据源（换库、换凭据、改 schemaMode 或重新启用）导致连接池重建时，绑定到它的代码对象会在新库上建表。
• 为什么改：service-datasource: a code object bound to a runtime (Setup-created) managed datasource never gets its table; registerPool connects with no objects, so reads 500 with 42P01 on create and after restart #27701 只修了"创建"和"重启"两条路；"修改后重建"仍不建表，换库后该对象每次读取都失败，只能手工建表。
• 风险与回滚：只对 schemaMode: managed 生效，external / validate-only 依旧零 DDL；重建失败保留旧池时不同步。回滚 = revert 本 PR。
• 先看：datasource-admin-plugin.ts 新的共用 helper managedObjectsBoundTo，以及 reconnect 新增的 objects 参数。
• 两分钟验证：pnpm --filter @objectstack/service-datasource exec vitest run src/__tests__/runtime-datasource-bound-object-storage.test.ts（新增 3 例；回退连接服务的改动后换库那例变红）。
• 需要你做的：无（Tier S，按本期落地授权由席位落地）。

What changes

• DatasourceConnectionService.reconnect takes an optional objects list and forwards it to both of its inner connect calls (the swap rebuild and the nothing-to-swap plain connect), so the connect's sync loop gives those objects their tables on the pool the new record opens. The kept-old-pool path syncs nothing.
• DatasourceAdminServicePlugin: the managed-only gate and bound-name list that registerPool computed inline (service-datasource: a code object bound to a runtime (Setup-created) managed datasource never gets its table; registerPool connects with no objects, so reads 500 with 42P01 on create and after restart #27701) moved into one helper, managedObjectsBoundTo, which both registerPool and reregisterPool call. reregisterPool passes the objects bound to the NEW record.
• ⛔ schemaMode: external / validate-only still pass no objects, so they never get DDL.

Why

#27701 synced bound managed objects when a runtime datasource's pool opens. An admin update that rebuilds the pool (PATCH /api/v1/datasources/:name → updateDatasource → reregisterPool → reconnect) still passed none, so moving warehouse to a new database left wh_note without a table there and every read of it failed.

Verification

• Pinned red on main first: in runtime-datasource-bound-object-storage.test.ts (real plugin, real ObjectQL, SQLite), create warehouse on a.db, update config to b.db → hasTable('wh_note') was false on b.db. Green with the fix; ablating the connection-service change turns it red again, restoring turns it green.
• New ⛔ cases: external and validate-only datasources updated to a new database sync nothing and create no table.
• @objectstack/service-datasource: 63 files / 1031 tests pass; tsc --noEmit clean.
• dispatch-gates --ran: 60 derived families accounted for: 59 run green, 1 NOT MEASURED (check:dual-build-cjs-loads, exit 3, needs a whole-tree build; CI runs it). pnpm lint exit 0. check:commit-card-trailers green.

Clause-②: no
Metadata-protocol: none

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: n/a.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

Serial note: draft PR #27819 (#27746) edits both files; this PR keeps to reconnect, registerPool / reregisterPool and the shared helper. The later lander merges main.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4d1ZEsJ6Xne4sn5EXtT

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-datasource, touching 2 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/external-datasources.mdx (via DatasourceAdminServicePlugin (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via DatasourceConnectionService (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef → packageMentionDocs.

Which tree this was computed on

This run read content/docs from db97f0ea77aef97c39ab6b5294d7b0ee56eef4f8 — the merge of head f0ef0a93476dc0a7c1f197d21c4b93a1d7ed56a9 into base c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin db97f0ea77aef97c39ab6b5294d7b0ee56eef4f8 && git checkout db97f0ea77aef97c39ab6b5294d7b0ee56eef4f8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef f0ef0a93476dc0a7c1f197d21c4b93a1d7ed56a9 && git checkout -B drift-repro c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef && git merge --no-ff f0ef0a93476dc0a7c1f197d21c4b93a1d7ed56a9

node scripts/docs-audit/affected-docs.mjs --json c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c4cb5ec0c3936dd2c24ae2aa9a349449d8e33bef → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia

Seat ACCEPT · PR #27874 · head f0ef0a93476dc0a7c1f197d21c4b93a1d7ed56a9 · 2026-10-30T02:46Z

维护者速读

An admin edit that rebuilds a Setup-created managed datasource's pool (a changed connection config, credential, schemaMode or active) now gives the code objects bound to it their tables on the new pool, as the create and restart path already does since #27701. external and validate-only datasources still never get DDL.

席位核对

• Shape: draft → main, with Fixes #27750. reconnect gains an objects option forwarded to both inner connect calls. The managed-only gate and the bound-name list move out of registerPool into one helper, managedObjectsBoundTo, which registerPool and reregisterPool both call, as triage asked for: one helper, not a copy. registerPool's behaviour is unchanged. The kept-old-pool path syncs nothing. datasource-admin-plugin.ts is on the surface by the seat's claim amendment on 6512977549. check-governed-merges --pr 27874: NOT governed, +86 / −14.
• Pin: red on main (config a.db → b.db left the bound table missing), green with the fix; ablating the connection-service change makes it red again.
• Gate check-runs on this head: 48 total, 35 success, 13 skipped by the path filter, 0 failed. mergeable_state: clean.
• Changeset: @objectstack/service-datasource patch.
• Declarations: Clause-②: no, Metadata-protocol: none. No contract review is owed.
• Serial: draft PR feat(service-datasource): a datasource naming a connector instance in external.connector borrows its credential, and its driver presents it per request (ADR-0015 D7) #27819 (service-datasource: a datasource driver resolves a borrowed connector credential through ADR-0143 D4's per-dispatch resolver (D7 runtime seam) — epic #27261 P2 #27746) edits both files. The later lander merges main.
• Landing: Tier S, under the maintainer's landing grant for this term (2026-10-29 22:05Z, seat thread). Ready + auto-merge through the relay.

ACCEPT