ci(temporal-conformance): give the non-SQL step the job's live PostgreSQL URL

[objectstack-fleet]

Fixes #21564
Clause-②: no

What this changes

The Temporal Conformance (live PG + MySQL) job's step "Run the non-SQL temporal backends under the skewed process zone" now sets OS_TEST_POSTGRES_URL in its env:, with the same literal the job's three SQL steps use (postgres://postgres:postgres@127.0.0.1:5432/postgres), for the postgres service the job already provisions. Until now that step set only TZ, so every service-analytics live-PostgreSQL cell (describe.skipIf(!config)) was a named skip there while the job read green.

The header clause "no CI step provisions that variable for this package" in 15 service-analytics test files becomes false with this wiring. It is corrected, comment-only, to name the step that now sets it. No other line of those files changes: every changed line in them is a * comment line. The 15th file, objectql-echo-date-bucket.test.ts, landed on main after this PR was opened, and the takeover added it (claim amendment 5973803595).

No other job, no other step, and no timeout changes. No cell is re-skipped.

What the step needed, measured (A2)

Only the one env: line:

• Build closure. turbo run build --filter=@objectstack/service-analytics... --dry=json selects 16 packages, including @objectstack/driver-sql, @objectstack/objectql and @objectstack/driver-sqlite-wasm (dev dependencies of service-analytics). The step's existing build already builds what the cells import.
• PostgreSQL client. pg is an optional peer of driver-sql, resolved by pnpm into driver-sql's knex instance; require.resolve('pg') from that knex answers pg@8.22.0. The cells reach pg through SqlDriver, so nothing is added to service-analytics.
• Database and tables. Every cell connects to the default postgres database and creates and drops its own tables. The table names are distinct across the 17 files that read the URL (os21316_deal, os21505_coercion, os21441_bucket_deal, ...), so parallel vitest workers do not collide.
• Server zone. The job's existing step "Point both servers at a non-UTC timezone" sets the server to Asia/Shanghai before any test step.

Readings

• A3. No service-analytics file reads OS_EXPECT_LIVE_DIALECT_MATRIX (git grep exit 1), and no code in the step's other four packages reads it. So the flag is not added to the step.
• A4. No service-analytics file reads OS_TEST_MYSQL_URL or any other server variable the job provides. Its only process.env reads are OS_TEST_POSTGRES_URL (34, in 17 files), NODE_ENV (10) and TZ (4). Nothing is listed for MySQL.
• A5. core, formula, driver-memory and driver-mongodb have zero OS_TEST_POSTGRES_URL hits (git grep exit 1 for each). Adding the variable to the step starts no test in them.

Acceptance

• CI, on this head 6e12d6934a: Temporal Conformance (live PG + MySQL) (job 111301243023) is success, and step 14, the step this PR wires, is success (3m38s). All 34 check runs are complete: 32 success, 2 skipped (Check Changeset under skip-changeset, and the opt-in packed-tarball smoke).
• The cells run in CI, by contrast with the head before the fix:
  • At a3fb6c0334, with this same wiring, step 14 failed. Four objectql-face-order-limit live-PostgreSQL cells went red on driver-sql on PostgreSQL: a month (or any) date bucket over a date column shifts by the server's timezone (::timestamptz AT TIME ZONE 'UTC'), so with a non-UTC server a calendar day lands in the previous bucket #21485's defect: a date month bucket landed a day early on a non-UTC server.
  • driver-sql on PostgreSQL: a month (or any) date bucket over a date column shifts by the server's timezone (::timestamptz AT TIME ZONE 'UTC'), so with a non-UTC server a calendar day lands in the previous bucket #21485 was fixed by PR fix(driver-sql): bucket a Field.date as its calendar day on PostgreSQL and MySQL #21611 (440cd329a9), which this branch now carries. With the same wiring, step 14 passes at 25fb56f1b7 and at 6e12d6934a.
  • That red-then-green on the same step shows the cells run there and now pass.
• NOT MEASURED: a quoted step-14 log line. The job-log host answers Forbidden from the seat containers, and the API's log tail does not reach step 14. A seat whose egress reaches the log host can read step 14's per-file vitest lines for objectql-face-order-limit and objectql-echo-date-bucket.
• Local reproduction of the job's two zones (PostgreSQL 16.14 with timezone=Asia/Shanghai, process TZ=America/New_York, the full service-analytics suite on the merged tree 25fb56f1b7, from vitest's JSON reporter):
  • With the URL: 4419 passed, 0 failed, 2 skipped of 4421.
  • Without it: 4160 passed, 261 skipped.
  • So 259 cells move from skipped to run.
  • objectql-face-order-limit: 26 / 0 / 0, including the four formerly red cells.
  • objectql-echo-date-bucket: 16 / 0 / 0.
  • The two remaining skips are cell-scoped by design: the SQLite cell's "the server is not on UTC" check in read-scope-temporal-coercion, and a SQLite-only case in analytics-faces-one-lowering. Their PostgreSQL twin, "(pg) the server is not on UTC", passed, so the run was not vacuous.

Acceptance notes

• The ruling says each of these cells "asserts a non-UTC server". At this tree, 1 of the 17 files does (read-scope-temporal-coercion.test.ts, show timezone). The other 16 rely on the job's provisioning step for the server's zone. Noted, not changed.
• packages/plugins/plugin-security/src/rls-boolean-comparand-door.test.ts:40 carries the same "no CI step provisions" clause about its own package. This PR's step does not run that package, so the clause there stays true and is not touched.
• Stall guard. check:stall-guard-budget reads this step's static budget as window 10m, cap 20m, job budget 30m, slack 10m. The step ran 3m38s on this head.
• Release. Nothing publishes: .github/workflows/ci.yml, plus comments in test files outside service-analytics's files[]. No changeset; skip-changeset.
• Governed. check-governed-merges.mjs: 0 of 16 paths hit the register, NOT governed; 118 changed lines (+80 / −38).

Gates

Run on head 6e12d6934a: the merge 1866c0185c of origin/main 5b5e83f446, plus the header commit. Each exit code was recorded before any pipe.

• dispatch-gates.mjs --commands derived 87 commands. All 87 ran, and all exited 0. --ran reconciled them as 87 derived, 87 run, 0 NOT-MEASURED.
• check:changeset-gate-self-tests was re-run once, alone, after the container's commit-signing hop answered 503 inside its scratch repository on the first pass. The re-run exited 0.
• service-analytics: its build closure built, and objectql-echo-date-bucket.test.ts passed without the URL (10 passed, 8 PostgreSQL cells skipped locally). Its full suite with the URL is in Acceptance above.

Opened by domain:spec seat 2 (session_01YDt3PzwfrkuFzUBF89WPmM); taken over by domain:spec seat 1 (session_01T9u38rswFp5Rw8DswRUReJ, claim 5973375306).

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5b5e83f446bde0bf6e13db304b9f07f115635704 → packageMentionDocs.