The primaryKeyReader three-signal union in service-datasource has no isPrimary producer left once the driver lands — collapse it to the spec spelling #11125

Blocked-by: #10676

Filed by the domain:engine execution seat (session_01RfyXxZ2WPjcjhuXpiQQc3y) as the consumer-side follow-up its own PR creates. Recording only — ⛔ no domain:* label; this lands in packages/services/service-datasource, which is not this seat's lane, and routing is triage's. The services seat asked for exactly this rather than an edit from the driver change.

What changes under it

PR #11124 (#10676 + #10998) aligns SqlDriver.introspectSchema() to the packages/spec introspection contract: columns carry primaryKey, and the retired isPrimary spelling is removed rather than emitted alongside.

ExternalDatasourceService's primaryKeyReader currently reads a three-signal union — col.primaryKey OR col.isPrimary OR table.primaryKeys.includes(col.name) — shipped by PR #11001 as a deliberate transitional belt while the two contracts disagreed. The maintainer ruling that ordered the driver alignment (2026-08-22, live session, 「同意所有」 item 9) permitted that belt for one release.

Once #11124 merges, the isPrimary arm has no in-tree producer. The belt is not broken — it keeps working precisely because it reads through a local cast ((col as { isPrimary?: unknown }).isPrimary) rather than through the interface, which is why removing the member does not touch it. That is good engineering and it is also what makes this easy to forget: nothing goes red, nothing complains, and a dead arm quietly becomes permanent.

Why the driver PR deliberately did not do it

The engine seat's dispatch authorised exactly one narrow cross-lane touch — updating external-introspection-seam.test.ts's producer-spelling assertion, which was built to redden on this flip — and ⛔ explicitly withheld authorisation to collapse the union read. Collapsing it is a judgement about how long the belt should outlive its producer, on a clock this lane does not own. The services seat's handoff note on #10676 says the same in the other direction: "Ping the services seat rather than editing it, or say so on this card and I will carve it." This card is that.

What the taker should check, not assume

• The isPrimary arm is the only dead one. table.primaryKeys remains a live, independent signal — the driver still emits it and it is the composite-key carrier (driver-sql: SQLite introspection reports only the FIRST column of a composite primary key (pk === 1 vs SQLite's 1,2,3… numbering) #10997). ⛔ Do not collapse the union to col.primaryKey alone without establishing what primaryKeys is doing for callers.
• external-introspection-seam.test.ts currently pins BOTH arms on purpose. Its updated comment says so: the union "no longer has an in-tree producer needing its isPrimary arm; collapsing it is this lane's call to make." Whichever way that call goes, that file is where it gets recorded.
• Out-of-tree producers. In-tree there are none after fix(driver-sql): introspectSchema() emits the spec introspection contract — primaryKey, dialect, introspectedAt (#10676, #10998) #11124; whether any external driver implementation emits the old spelling is unmeasured here.
• The defaultValue / indexes divergences the driver kept deliberately (unknown rather than string; indexes omitted rather than emitted empty) are not part of this — they are documented divergences, not drift.

Provenance

• External object-draft drops the introspected primary key (isPrimary vs primaryKey seam) #10676 / driver-sql: introspectSchema() returns only { tables } — the spec IntrospectedSchema contract's dialect and (required) introspectedAt are never emitted #10998 — the driver alignment (this card's Blocked-by: fires when they close).
• PR fix(driver-sql): introspectSchema() emits the spec introspection contract — primaryKey, dialect, introspectedAt (#10676, #10998) #11124 — the change that empties the arm.
• PR fix(service-datasource): read the introspected primary key at the isPrimary/primaryKey seam #11001 — shipped the belt, with its own reasoning for a union rather than a precedence chain.
• External object-draft renders a field key that is not authorable: fields.<f>.primaryKey fails tsc against ServiceObject and ObjectSchema.safeParse #11000 — unrelated despite the shared word, and still unruled: fields.<f>.primaryKey authorability in a rendered object definition is a different key in a different place.