fix(spec): register sys_license as a cloud-provided platform object

[claude]

Fixes #13842

sys_license joins CLOUD_PROVIDED_OBJECT_NAMES in
packages/spec/src/system/constants/platform-object-names.ts, so
isPlatformProvidedObjectName('sys_license') now returns true and a
cloud-targeted stack that references the object resolves instead of being
warned about a probable typo.

Premise re-checked on origin/main (branch base e5812fa43)

Route 1 — the registry is missing a real cloud-provided object — holds. Route 2
(re-pointing driver doc comments and fixtures at a different object) is not
taken: every citation names an object that genuinely exists.

• Absent from the registry:
  git grep -n "sys_license" origin/main -- packages/spec/src/system/constants/platform-object-names.ts
  returns nothing (exit 1).
• Nothing in this repo declares it:
  git grep -n "name: 'sys_license'" origin/main -- '*.object.ts' returns
  nothing (exit 1), which is why the conformance scan never flagged the gap.
• The citations named on the card all exist on origin/main today:
  • packages/spec/src/data/object.zod.ts:695 — the platform-global note on
    ObjectSchema (sys_license keeps an optional owner FK)
  • packages/spec/src/data/object.test.ts:1896, :1992, :2088, :2100 —
    the isTenancyDisabled worked example
  • packages/drivers/driver-sql/src/sql-driver.ts:4264, :9182 — doc comments
  • packages/drivers/driver-sql/src/sql-driver-tenant-scope.test.ts:308-:385
  • packages/drivers/driver-sqlite-wasm/src/sqlite-wasm-driver-tenant-scope.test.ts:211-:277
  • packages/drivers/driver-memory/src/memory-tenancy-guard.test.ts:117, :221
  • packages/drivers/driver-mongodb/src/mongodb-tenancy-guard.test.ts:134
  • packages/lint/src/validate-capability-references.test.ts:12, :43, :49
  • packages/cli/src/commands/migrate/duplicates.probe-sql.test.ts:127, :161
  • docs/adr/0066-unified-authorization-model.md:68 — the worked example the
    object was designed against

The cloud declaration, re-cited from the checkout rather than taken on trust

git -C ../cloud grep -n "name: 'sys_license'" origin/main on cloud
origin/main 3856fbf7cf7ca27f979df5232b9639da4058bf42:

packages/service-tenant/src/objects/sys-license.object.ts:26

24 files in that repository reference the name. It ships from
@objectstack/service-tenant — the same package that provides the five names
already on the list, so the positive control (sys_package_installation) hits
the same tree.

The change

One name added to CLOUD_PROVIDED_OBJECT_NAMES, in the neighbours' alphabetical
order and their provenance style (the group docstring carries the provenance;
the entries themselves are bare). Nothing else in the module moves.

This is precisely the failure the module's own maintenance contract describes:

an out-of-date registry is worse than the heuristic it replaced, because
consumers now trust it.

Pins

packages/spec/src/system/constants/platform-object-names.test.ts already loops
over CLOUD_PROVIDED_OBJECT_NAMES generically, so the new entry is covered the
moment it lands (it is asserted platform-provided, and asserted not declared
in this repo). No count or enumeration pin needed updating — there is none.

Added beside the existing sys_user / sys_approval_request predicate pins: a
named positive control asserting sys_license resolves as cloud-provided, so
removing it fails one readable assertion rather than nothing.

No consumer behaviour moves for any name already on the list. The two consumers
that key on the registry both abstain here:
ObjectQLEngine.resolvePrimaryDatasource intersects the list with what the
deployment actually registered (an OSS runtime registers no sys_license), and
validate-object-references gains one more did-you-mean candidate for names
that are already findings.

Gates, on the final head e96026948

Derived mechanically, no paths passed:
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(53 commands; the script reads the change set from the merge base itself), plus
check:nul-bytes = 54. Every exit code captured by redirect before any pipe.
Working tree still clean afterwards, so nothing regenerated anything, and the
whole union ran on this exact tree.

49 of 54 exit 0. Including check:api-surface, check:authorable-surface,
check:export-origins, check:docs, check:liveness, check:generated
("All 15 generated artifacts are up to date"), check:type-check-coverage,
check:cross-package-test-inputs, check:merge-driver, check:published-files,
check:test-source-alias, check:nul-bytes.

Tests and typecheck:

• pnpm --filter @objectstack/spec typecheck — exit 0. Coverage proven rather
  than assumed: the base tsconfig.json compiles 0 of the edited test file, the
  sibling tsconfig.test.json (which typecheck reaches via
  check:test-typecheck) compiles 1 — checked with tsc --listFiles.
• vitest run --maxWorkers=2 src/system/constants/platform-object-names.test.ts
  — exit 0, 8/8.
• Full spec suite, complete, in shards. The container caps a foreground
  command at ~10 minutes, so the suite was sharded rather than narrowed:
  --shard=1/2 226 files / 6172 tests; --shard=3/4 113 / 2705; --shard=4/4
  minus its one slow file 112 / 3324; that file
  (scripts/publish-smoke-port-collision.test.ts, a port-collision smoke test
  this diff cannot reach) run alone, 8/8 in 6.5s. Union = all 452 files, 12209
  tests, exit 0 throughout.

5 of 54 NOT MEASURED — none is a red, and all five have one cause: only
packages/spec and its dependency closure were built locally, not the full
67-package workspace. Each gate says so in its own words and names pnpm build
as the fix; CI builds the workspace, so all five are measured there.

• check-dev-prereqs exit 1 — "The workspace is not built ... 1 unmet
  precondition, not a list of problems."
• check:dual-build-cjs-loads exit 3 — "PREREQUISITE NOT MET ... This is NOT a
  pass: nothing was measured." (Its 93-case self-test does pass.)
• check:type-check-debt exit 3 — refuses to re-measure through unbuilt
  dependencies: "NOT a pass and NOT a finding". Its sibling
  check:type-check-coverage is green.
• @objectstack/lint check:doc-formula-expressions exit 3 — needs
  @objectstack/formula compiled.
• check-test-completeness exit 3 — its own text: the derived family names it
  with no argument, "so the local reading for this gate is NOT MEASURED".

Note on the shared verify lock: builds and the test suite were run under
scripts/pm/os-verify-lock.sh. The remaining static check:* audits were run
unlocked — that lock's own --status text states it does not cover gate
scripts — after two acquisitions returned exit 99 (queue-timeout) against a
long holder. No coverage was narrowed by that choice.

Declarations

Clause-②: no — a registry constant gains a name that already exists; no
accept-set change on any schema, no authorable surface moves.

Changeset: @objectstack/spec patch (a published constant gains a name).

Agent session: https://claude.ai/code/session_01GDA48PuRFrHyRfdkBz8m21

🤖 Generated with Claude Code

https://claude.ai/code/session_01GDA48PuRFrHyRfdkBz8m21

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via sys_license (literal, a string literal in CLOUD_PROVIDED_OBJECT_NAMES))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 128 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b339a38377036095c180e010921b04331d5e5bd2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 975ff9b27af5f5a55760b849d7f6e2e9ed242fa5 — the merge of head e9602694896e5374c7eb0da48cede80a8b616d04 into base b339a38377036095c180e010921b04331d5e5bd2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 975ff9b27af5f5a55760b849d7f6e2e9ed242fa5 && git checkout 975ff9b27af5f5a55760b849d7f6e2e9ed242fa5
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b339a38377036095c180e010921b04331d5e5bd2 e9602694896e5374c7eb0da48cede80a8b616d04 && git checkout -B drift-repro b339a38377036095c180e010921b04331d5e5bd2 && git merge --no-ff e9602694896e5374c7eb0da48cede80a8b616d04

node scripts/docs-audit/affected-docs.mjs --json b339a38377036095c180e010921b04331d5e5bd2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b339a38377036095c180e010921b04331d5e5bd2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.