@@ -0,0 +1,16 @@
+---
+'@objectstack/service-package': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/cloud-connection': patch
+---
+
+fix(cloud-connection): an unmanaged copy is recorded from the row the import wrote, not from a store re-read at install
+
+Clause-②: no
+Metadata-protocol: none
+
+Before this, the install-local door tied an unmanaged copy's record to the environment base's `sys_packages` row by reading the package store right after the import. That read swallows an ordinary fault and answers null, so a passing store fault at that moment left the copy with no record, and the purge, reseed and count doors answered 404 for a copy that was installed.
+
+- **`publish` states the stamp it writes.** The package service now makes one UTC stamp per write, in the shape the column already stores (`YYYY-MM-DD HH:MM:SS`, what `CURRENT_TIMESTAMP` and `UTC_TIMESTAMP()` produced), and binds it as the row's `created_at` and `updated_at` in both dialects' upserts. `publish` answers `{ success: true, version, createdAt }`, where `createdAt` is the value the row holds after the write. On a re-publish of an existing (id, version) row the stored `created_at` stays the earlier one, as before (the update arm sets only `updated_at`), so `publish` reads that row's `created_at` before its upsert and answers it. When that read faults, the answer names no `createdAt`. The table DDL and the latest index are unchanged.
+- **The import carries the base row, door-only.** The in-process `importUnmanagedPackage` answer gains `baseInstance: { version, createdAt }` when the package store stated them. It is outside the published `ImportUnmanagedPackageResponse`: the schema's parse strips it, and no REST answer carries it.
+- **install-local ties the record from that answer.** The install no longer reads the package store. A package store that states no stamp fails closed as before: `copyRecord.written: false`, and the copy doors answer 404. The purge-time re-read and its comparison are unchanged.
@@ -662,7 +662,13 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
      * driver error (a lock timeout, a dropped connection) is caught, logged and
      * answered `null`; only the seam-unreadable refusal escapes, as a 503.
      */
-    function world(opts: { packageStore?: boolean; grantless?: boolean } = {}) {
+    function world(opts: {
+        packageStore?: boolean; grantless?: boolean;
+        /** [#31530] A passing store fault armed when the import returns: the next store `get` meets it. */
+        faultAfterImport?: 'ordinary' | 'seam';
+        /** [#31530] The import's write names no stored row (a package service that states no stamp). */
+        noBaseInstance?: boolean;
+    } = {}) {
         const tables: Record<string, Row[]> = {};
         const objects = new Map<string, any>();
         const packages = new Map<string, { manifest: Record<string, unknown> }>();
@@ -687,7 +693,8 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
                 return null;
             }
         });
-        const storeFault = (kind: 'ordinary' | 'seam') => { fault = kind; };
+        /** Arm a fault for the next store `get`; `undefined` disarms one that was never met (a passing fault). */
+        const storeFault = (kind: 'ordinary' | 'seam' | undefined) => { fault = kind; };
         const writes: string[] = [];
         let nextId = 0;
         const known = (object: string) => {
@@ -763,7 +770,8 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
                 });
             }
             packages.set(targetPackageId, { manifest: { id: targetPackageId, namespace: source.namespace } });
-            packageRows.set(targetPackageId, { version: '1.0.0', created_at: `2026-11-08 07:00:${String(++stamp).padStart(2, '0')}` });
+            const baseRow = { version: '1.0.0', created_at: `2026-11-08 07:00:${String(++stamp).padStart(2, '0')}` };
+            packageRows.set(targetPackageId, baseRow);
             const copied: Array<{ type: string; name: string }> = [];
             for (const o of source.objects ?? []) {
                 objects.set(o.name, o);
@@ -778,7 +786,12 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
                     copied.push({ type: 'seed', name });
                 }
             }
-            return { sourcePackageId: source.id, targetPackageId, namespace: source.namespace, copiedCount: copied.length, copied, strippedLocks: [] };
+            if (opts.faultAfterImport !== undefined) fault = opts.faultAfterImport;
+            return {
+                sourcePackageId: source.id, targetPackageId, namespace: source.namespace, copiedCount: copied.length, copied, strippedLocks: [],
+                // [#31530] The base row as the import's own write answered it; none with no package service.
+                ...(opts.packageStore === false || opts.noBaseInstance ? {} : { baseInstance: { version: baseRow.version, createdAt: baseRow.created_at } }),
+            };
         });
         // [#31425] The metadata service's object read the seed run's dependency graph asks; a spy, so a case can make one load throw.
         const metadataGetObject = vi.fn(async (name: string) => objects.get(name));
@@ -1086,6 +1099,27 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
         expect(res.payload.data).toMatchObject({ deleted: 3, errors: 0 });
     });
 
+    it('[#31530] a passing store fault right after the import still records the copy, tied to the row a later read answers, and the purge reaches it', async () => {
+        for (const kind of ['ordinary', 'seam'] as const) {
+            rmSync(join(dir, 'unmanaged-copies'), { recursive: true, force: true });
+            const w = world({ faultAfterImport: kind });
+            const h = await w.boot();
+            const res = await h.install({ manifest: seededCrm(), installMode: 'unmanaged', seedSampleData: true });
+            expect(res.status, `${kind}: ${JSON.stringify(res.payload)}`).toBe(200);
+            expect(res.payload.data).not.toHaveProperty('copyRecord');
+            // Nothing read the store at install: the fault is still armed. It passes.
+            expect(w.packageGet).not.toHaveBeenCalled();
+            w.storeFault(undefined);
+            // The record is tied to exactly what a later store read answers for the row.
+            const record = JSON.parse(readFileSync(COPY_RECORD(), 'utf8'));
+            const row = await w.packageGet('com.example.crm-copy');
+            expect(record.instance).toEqual({ version: row!.version, createdAt: row!.created_at });
+            const purged = await h.purge('com.example.crm-copy');
+            expect(purged.status, `${kind}: ${JSON.stringify(purged.payload)}`).toBe(200);
+            expect(purged.payload.data).toMatchObject({ deleted: 3, errors: 0 });
+        }
+    });
+
     it('with no `package` service the record holds no instance and the purge reaches the copy by id alone (the stated residual)', async () => {
         const w = world({ packageStore: false });
         const h = await w.boot();
@@ -1111,21 +1145,20 @@ describe('install-local — an unmanaged copy\'s sample data, asked for with `se
             expect((await h.purge('com.example.crm-copy')).status).toBe(404);
             rmSync(join(dir, 'unmanaged-copies'), { force: true });
         }
-        // The package store meets a fault at install — an ordinary error it
-        // answers null, or the seam refusal it throws: no record is written,
-        // and the copy stays unrecorded (re-recording is #31425).
-        for (const kind of ['ordinary', 'seam'] as const) {
-            const w = world();
+        // [#31530] The import names no stored row while a package service is
+        // mounted (a service that states no stamp): no record is written, and
+        // the copy stays unrecorded, failing closed (re-recording is #31425).
+        {
+            const w = world({ noBaseInstance: true });
             const h = await w.boot();
-            w.storeFault(kind);
             const res = await h.install({ manifest: seededCrm(), installMode: 'unmanaged', seedSampleData: true });
-            expect(res.status, `${kind}: ${JSON.stringify(res.payload)}`).toBe(200);
+            expect(res.status, JSON.stringify(res.payload)).toBe(200);
             expect(res.payload.data.copyRecord).toEqual({
-                written: false, message: expect.stringContaining('the package store did not answer with the new base\'s row'),
+                written: false, message: expect.stringContaining('the import did not answer with the new base\'s stored row'),
             });
-            expect(res.payload.data.copyRecord.message).not.toContain('SQLITE_BUSY');
             expect(existsSync(COPY_RECORD())).toBe(false);
             expect((await h.purge('com.example.crm-copy')).status).toBe(404);
+            rmSync(join(dir, 'unmanaged-copies'), { recursive: true, force: true });
         }
         // A record that is kept adds no key to the answer.
         {
 
@@ -4869,10 +4869,10 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         // operator in the log.
         let copyRecordFailure: string | undefined;
         let copyRecordSaid: string | undefined;
-        const tie = await this.unmanagedCopyInstance(ctx, result.targetPackageId);
+        const tie = this.unmanagedCopyInstance(ctx, result.targetPackageId, result.baseInstance);
         if ('failure' in tie) {
             copyRecordFailure = tie.failure;
-            copyRecordSaid = 'the package store did not answer with the new base\'s row';
+            copyRecordSaid = 'the import did not answer with the new base\'s stored row';
         } else {
             try {
                 this.unmanagedCopies.write({
@@ -5892,34 +5892,32 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
     };
 
     /**
-     * [#30808] The base instance a new copy's record is tied to: the package
-     * store's row of `baseId` ({@link readUnmanagedCopyInstance}). No
-     * `instance` on a runtime with no `package` service (the record's reach is
-     * then by id alone — the residual its module docblock states); a
-     * `failure`, and so no record, when the store holds no readable row —
-     * which is also what a passing store error reads as, since the store
-     * answers `null` for it. That copy stays unrecorded (`copyRecord` says
-     * so); no door records it later. The copy is still installed, and
-     * reseed, count and purge answer 404 for it (#31425 measured: the store's
-     * `null` cannot be told from "no row" here; a follow-up has the import
-     * answer the base row's stamp itself).
+     * [#30808, #31530] The base instance a new copy's record is tied to: the
+     * base's `sys_packages` row (`version`, `created_at`) as the import's own
+     * write answered it (`baseInstance`), never a read of the store after
+     * the import. A read could meet a passing store fault, which the store's
+     * `get` answers as `null`, and leave the copy unrecorded for good (#31425).
+     * No `instance` on a runtime with no `package` service (the record's
+     * reach is then by id alone: the residual its module docblock states). A
+     * `failure`, and so no record, when there is a `package` service but the
+     * import named no stored row (a package service that states no stamp):
+     * the copy then stays unrecorded and `copyRecord` says so, failing closed
+     * as before. The purge, reseed and count doors read the row again and
+     * compare it with this instance ({@link readUnmanagedCopyInstance}).
      */
-    private unmanagedCopyInstance = async (
+    private unmanagedCopyInstance = (
         ctx: PluginContext,
         baseId: string,
-    ): Promise<{ instance?: UnmanagedCopyInstance } | { failure: string }> => {
+        stored: { version?: unknown; createdAt?: unknown } | undefined,
+    ): { instance?: UnmanagedCopyInstance } | { failure: string } => {
+        if (typeof stored?.version === 'string' && stored.version !== ''
+            && typeof stored.createdAt === 'string' && stored.createdAt !== '') {
+            return { instance: { version: stored.version, createdAt: stored.createdAt } };
+        }
         let store: Partial<UnmanagedCopyPackageStore> | undefined;
         try { store = ctx.getService<Partial<UnmanagedCopyPackageStore>>('package'); } catch { return {}; /* no package store */ }
         if (typeof store?.get !== 'function') return {};
-        let held: UnmanagedCopyInstance | null | undefined;
-        try {
-            held = await readUnmanagedCopyInstance(store as UnmanagedCopyPackageStore, baseId);
-        } catch (err: any) {
-            return { failure: `the package store could not be read for '${baseId}': ${err?.message ?? err}` };
-        }
-        if (held === null) return { failure: `the package store holds no row of '${baseId}'` };
-        if (held === undefined) return { failure: `the package store's row of '${baseId}' carries no readable version and created_at` };
-        return { instance: held };
+        return { failure: `the import named no stored row of '${baseId}' (its package store stated no version and created_at)` };
     };
 
     /**
 
@@ -36,29 +36,36 @@
  * or an uninstall racing the record write. A later base under the same id —
  * a Studio duplicate also defaults to `<sourceId>-copy` — must not inherit
  * the purge. So the record also keeps the base's `instance`: the `version` and
- * `created_at` of the base's row in the package store (`sys_packages`, read
- * through the `package` service's `get`). The store mints `created_at` when it
- * first inserts the row, keeps it when the same base is published again, and
- * an uninstall deletes the row, so a later base under the same id gets a row of
- * its own. The purge reads the row again and answers 404 when it is gone or its
- * `created_at` differs.
+ * `created_at` of the base's row in the package store (`sys_packages`). At
+ * install they come from the import's own answer (`baseInstance`, #31530): the
+ * package service's `publish` answers the `created_at` the row holds after its
+ * write (the stamp it bound for a new row, the row's own for one already
+ * stored), so the door never reads the row back after the copy. The store sets `created_at`
+ * when it first inserts the row, keeps it when the same base is published
+ * again, and an uninstall deletes the row, so a later base under the same id
+ * gets a row of its own. The purge reads the row through the `package`
+ * service's `get` and answers 404 when it is gone or its `created_at` differs.
  *
  * What it leaves:
  *   - a runtime with no `package` service persists no base row; the record
  *     then holds no `instance`, and the purge's reach is by id alone — the
  *     condition above stays open there (such a base does not survive a
  *     restart either);
- *   - `created_at` is the store's `CURRENT_TIMESTAMP`, so a base uninstalled
+ *   - `created_at` is a `YYYY-MM-DD HH:MM:SS` UTC stamp, so a base uninstalled
  *     and re-created under the same id within the same second shares it;
+ *   - a package service whose `publish` states no stamp (including one whose
+ *     read of an already-stored row before its write faulted) leaves the import with
+ *     no `baseInstance`; the door then writes no record and `copyRecord` says
+ *     so (it fails closed, and no door writes that record later: the record's
+ *     proof is the door's own act at install, and neither the base row nor
+ *     its receipt marks a base as a copy, #31425);
  *   - the store's `get` catches an ordinary driver error (a lock timeout, a
  *     dropped connection), logs it and answers `null`; only its
- *     seam-unreadable refusal is thrown. So a passing store error reads as
- *     "no row": at purge the copy answers 404 (the purge refuses, nothing is
- *     deleted), and at install no record is written and `copyRecord` says so;
- *     no door writes that record later: the record's proof is the door's own
- *     act at install, and neither the base row nor its receipt marks a base as
- *     a copy (#31425). Both fail closed. Only the seam refusal reaches the
- *     purge as a 503.
+ *     seam-unreadable refusal is thrown. At install this no longer matters
+ *     (#31530: nothing is read there). At purge, reseed and count a passing
+ *     store error reads as "no row", and the copy answers 404 (the door
+ *     refuses, nothing is deleted); it fails closed, and the next call reads
+ *     the row again. Only the seam refusal reaches those doors as a 503.
  */
 
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 
@@ -32,7 +32,7 @@
  */
 // Pays the lint root's first load at collection, never inside a clocked case.
 import './lint-root-preload.testkit.js';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { assertEngineDeleteDispatch, assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 import { ImportUnmanagedPackageResponseSchema } from '@objectstack/spec/api';
 import { DEFAULT_METADATA_TYPE_REGISTRY, getMetadataTypeSchema, listMetadataTypeSchemaTypes } from '@objectstack/spec/kernel';
@@ -1364,3 +1364,34 @@ describe('the sample data, copied when the door asks — the seed receipt (#3080
         expect(resolveThrownHttpError(err).status).toBe(400);
     });
 });
+
+describe('[#31530] the base row, as its own write answered it (`baseInstance`, door-only)', () => {
+    /** The protocol over the stub engine, with a `package` service whose `publish` answers `answer`. */
+    function withPackageService(answer: (manifest: any) => unknown) {
+        const harness = makeEngine();
+        const published: any[] = [];
+        const packageService = {
+            publish: vi.fn(async ({ manifest }: { manifest: any }) => { published.push(manifest); return answer(manifest); }),
+        };
+        const protocol = new ObjectStackProtocolImplementation(harness.engine, () => new Map([['package', packageService]])) as any;
+        return { ...harness, protocol, published, packageService };
+    }
+
+    it('answers the base row the package service\'s write answered, beside the published answer', async () => {
+        const { protocol, published } = withPackageService((manifest) => ({ success: true, version: manifest.version, createdAt: '2026-11-08 14:40:07' }));
+        const result = await protocol.importUnmanagedPackage({ manifest: crmBody() });
+        expect(published.map((m) => m.id)).toEqual(['com.example.crm-copy']);
+        expect(result.baseInstance).toEqual({ version: published[0].version, createdAt: '2026-11-08 14:40:07' });
+        // Door-only: outside the published answer, whose declaration still reads every other key.
+        const { baseInstance: _door, ...answer } = result;
+        expect(ImportUnmanagedPackageResponseSchema.parse(answer)).toEqual(answer);
+        expect(ImportUnmanagedPackageResponseSchema.parse(result)).not.toHaveProperty('baseInstance');
+    });
+
+    it('answers none when the write named no stamp, or when there is no package service', async () => {
+        const silent = withPackageService(() => ({ success: true }));
+        expect(await silent.protocol.importUnmanagedPackage({ manifest: crmBody() })).not.toHaveProperty('baseInstance');
+        const { protocol } = makeProtocol();
+        expect(await protocol.importUnmanagedPackage({ manifest: crmBody() })).not.toHaveProperty('baseInstance');
+    });
+});