Repository navigation
install-local: an unmanaged copy's sample rows outlive its uninstall, cannot be reseeded, and a failed seed load cannot be retried #31425
Description
domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy
Filing gate: ① a product gap with a named landing. It was carried from contract-review records 6718084382 (round 1, should-fix S6) and 6718682580 (delta) on PR #31398 (#30808), where the reviewer escalated it as out of scope.
Reach: once #30808 lands, every unmanaged install made with sample data. The hosted deep link (cloud#3626) turns that switch on for gallery visitors.
Dedupe (open AND closed): "unmanaged copy uninstall seed rows" → 10 hits, "unmanaged copy reseed" → 6, "seed-receipt-unread" → 38, "install-local copy seed reload" → 47. None is this gap. The nearest are #30808 (where it was found), #15213 (template mode, closed; Q3 = A puts reseed and purge on ledger entries) and #30616 / #30323 (sample-data UI, closed).
Reader: the domain:server seat that owns the install-local door (non-identity service face), from pm:queue, after #30808 lands.
维护者速读
- 问题： 以"无托管副本"方式安装应用并带上示例数据后，有三件事做不到：
- 卸载副本时示例数据行留在库里；
- 不能重新灌示例数据；
- 第一次灌数据失败（
seed-receipt-unread/seed-error）后无法重试，再装一次会回 409。
现在只有"清空示例数据"（purge）这一扇门。
- 影响面： An unmanaged install can copy the package's seed data, removable as one batch, owned by the installer (gallery demos need data) #30808 合并后，所有带示例数据的无托管安装。托管深链（cloud#3626）上线后，画廊访客也会碰到。
- 需要您做的： 无。
Today (as #30808 builds it, PR #31398)
- The copy's seed receipt is the base's own
seeditems in the environment ledger. The rows are loaded from those items, and purge reads the same receipt. - Uninstalling the base removes the receipt and the door-private copy record, and leaves the rows in place.
- Reseed and the sample-data count act on install-ledger entries (feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213 Q3 = A). An unmanaged install writes no ledger entry, so neither one reaches a copy.
- A re-run of the copy after a failed seed load answers 409, and no door re-loads from the receipt.
Task
- Decide, with the four-axis analysis in the PR, whether uninstalling a copy purges its sample rows (as a managed uninstall's cleanup does), or keeps them and says so in the answer.
- Reseed and the count reach a recorded copy through the same receipt that purge reads. Do not add a ledger entry.
- A re-load door, or the reseed door, can retry a copy whose seed load failed, from the stored receipt.
- Pin each path red then green, and ablate the pins.
Clause-②: yes (widening) if a door starts serving a copy it refuses today; the dev confirms from the diff. Metadata-protocol: none.
Precondition: PR #31398 (#30808) merged. Until then this card is pm:blocked.
Suggested-grade: p2. Data left behind after an uninstall is user-visible, and the hosted flow makes it common.
🤖 Generated with Claude Code
Activity
objectstack-fleet commentedon Nov 8, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 ·
domain:server· confirmed · 2026-11-08T07:54Z⛔ Not a claim.
pm:blockeduntil An unmanaged install can copy the package's seed data, removable as one batch, owned by the installer (gallery demos need data) #30808 lands.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy
Scope addition · 2026-11-08T08:10Z · from round-3 contract review on PR #31398 (should-fix S9, install half). If the package store's
getreturnsnullon an ordinary database error during the install, the door writes no copy record. The answer reports that incopyRecord: { written: false }, but no door ever writes the record later, so that copy stays outside the purge's reach permanently. Nothing is reached by mistake, because the failure is closed. This card's reseed/retry door should also be able to (re)write the copy record for a base this door copied. Only do that where the base row and the receipt prove the base is a copy; never on an id alone.objectstack-fleet commentedon Nov 8, 2026
domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy
Unblocked · 2026-11-08T09:07Z · The card's precondition is met: PR #31398 (#30808) merged at 2026-11-08T09:05Z as
1ff99441d8. Movedpm:blocked→pm:queue. ⛔ Not a claim.objectstack-fleet commentedon Nov 8, 2026
domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ
Claim: PM loop round 1 · 2026-11-08T11:06Z
Session:
session_01FEkQ5ktJb5rQ5n2GUXSQMR(card thread, dev) · seatsession_01FEkQ5o8PE7ZtVjcor51wBZAccount:
os-project-managerBranch:
claude/project-thread-f6p2x0Worktree:
objectstack-issue-31425Domain:
domain:serverSeat:
domain:server#5File surface:
packages/cloud-connection/src/marketplace-install-local-plugin.ts(copy uninstall, purge, the copy path), the reseed / sample-data-count door it reaches + tests, root.changeset/Container & model: M,
mode:thread,model: default tier(dispatch-gates --tier: no path-derived mandate),effort: thread defaultClause-②: yes (widening) — expected: reseed / count / retry now serve a copy they refuse today; the dev confirms from the real diff and adds the narrowing arm if anything accepted today is refused (the store-null scope addition); one contract review at the face the line names before the queue
Metadata-protocol: none
Responsibility:
cloud-connectioninstall-local unmanaged copy (objectstack) | a copy's sample rows outlive its uninstall, reseed and the count never reach a copy, a failed first seed load cannot be retried (409), and a storegetanswering null on a database error reads as absent | every unmanaged install with sample data, and the hosted gallery deep link (cloud#3626)Thread-read: 6719630032
Premise: holds per the filer's reading on #30808's merged code (
1ff99441d8); the dev measures red on main firstSerial constraints cleared: cleared — #31388, #31439, #31476 (same file) merged; fourth link of the same thread
Scope: Fixes #31425. The card's Task as written plus seat 3's scope addition 6719110205; one receipt reader, no new ledger entry; the uninstall choice argued on the four axes,
needs_decisionif outside the rulings. Order:/mnt/project-files/pm-orders/server/order-31425.md. Summons: the maintainer's 「server 再开两个座位」「并发都是5」 (this project, 2026-11-07); grading per 「定级你可以自己决定」 is triage's here (graded on the card).objectstack-fleet commentedon Nov 8, 2026
domain:server#5 · os-project-manager · session_01FEkQ5ktJb5rQ5n2GUXSQMR
os-dev-report
{
"issue": 31425,
"status": "done",
"branch": "claude/project-thread-f6p2x0",
"pr": "#31525",
"session": "session_01FEkQ5ktJb5rQ5n2GUXSQMR",
"premise_still_valid": true,
"summary": "Premise measured on main 2ae3e30: reseed and the sample-data count answered 404 for a recorded unmanaged copy, and a copy whose first seed load failed (seed-receipt-unread, seed-error) could not be loaded again. Both doors now reach a copy through the purge's own receipt reader, renamed unmanagedCopySeedDatasets (one reader, no new ledger entry). The reseed runs the receipt's datasets through the install's copy seed run (seedUnmanagedCopy, rows owned by the caller) and answers through the ledger reseed's own shaping (reseedAnswer); that is also the retry. The count is the purge's match. The 503 for an unread receipt is shared by the three doors. Two premises did not hold and the seat agreed the handling (see open_questions): the uninstall half needs no code (measured on a real boot: DELETE /packages/:baseId drops the copy's tables by default, and keepData keeps every row), and the re-record half cannot be proved from the base row and receipt, so the install-time null is measured and stated, with option (b) named as a follow-up. Clause-② from the diff: yes (widening) only.",
"tests": "Seven new cases in packages/cloud-connection/src/marketplace-install-local-install-modes.test.ts (#30808 copy harness, real SeedLoaderService): reseed puts purged rows back owned by the reseeder, idempotent second run, nothing ledgered; count 3 then 0 after purge; retry after seed-receipt-unread; retry after seed-error; Studio base and no-base id 404 on reseed and count, nothing written; copy without sample data -> reseed 400 RESEED_SKIPPED, count 0; unreadable receipt -> 503 on reseed and count, store text not quoted. RED on 2ae3e30: 'expected 404 to be 200' etc., 'Tests 6 failed | 52 passed (58)' (the 7th, the 404 negative pin, passes on main by construction). ABLATIONS on fix 7bb1588 (src-relative import, no build): (1) count reads an unread receipt as 0: 'blob cf4f8a823d58 -> 5d41b24e356e', 'Tests 1 failed | 57 passed (58)', restored == HEAD; (2) reseed reads it as a skipped run: 'blob cf4f8a823d58 -> 84c801a8af03', 'Tests 1 failed | 57 passed (58)', restored; (3) the shared reader reaches a base with no record: 'blob cf4f8a823d58 -> 7f2d6d85a54d', 'Tests 5 failed | 53 passed (58)' (four #30808 purge pins plus the new reseed/count 404 pin), restored. UNINSTALL PROBE (throwaway, not committed; showcase boot, CRM copy with 28 sample rows): default DELETE /packages/com.example.crm-copy 200, a reinstall without sample data finds 0 rows in all five objects; ?keepData=true 200, the reinstall finds all 28+1 rows (names Acme Corp, Globex Ltd, Initech, User Authored Co), purge 404 after the uninstall and 400 NOTHING_TO_PURGE on the reinstall. Head 6cf7abe: cloud-connection 'Test Files 75 passed (75) Tests 1024 passed (1024)' exit 0; typecheck exit 0.",
"gates": "Head 6cf7abe, after pnpm turbo run build --concurrency=2 (VERDICT 0, 120/120). dispatch-gates --commands --repo objectstack-ai/objectstack: 99 families (the same list as on ff76c20), all exit 0 on first run (record /mnt/project-files/pm-orders/server/31425-gates-ran.txt). --ran: '99 derived famil(ies) accounted for — 99 run, 0 NOT-MEASURED (a DERIVED zero — all 99 recorded an exit code and none of them is 3)'. The same union was also run whole on ff76c20, 99/99 exit 0. pnpm check:facade-delegation-only exit 0. eslint --no-inline-config on the three touched .ts files exit 0. CI families: PR #31525 check-runs, read by the seat.",
"dogfood_battery": "ff76c20e (before the conflict merge) · os-verify-lock: VERDICT command-exit 0 (held 40m13s) · Test Files 439 passed | 3 skipped (442) · Tests 3629 passed | 41 skipped (3670) · no failures; not re-run on 6cf7abe (widening only, no narrowing arm)",
"mcp_calls": "2 (GitHub reads: issue_read get and get_comments on #31425); 0 writes",
"api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches, fleet-write run 42482361520, read-back identical, PR #31525, no assignees) and this report comment via post-stamped.mjs; git push is not a REST write",
"open_questions": [
{
"status": "answered_by_seat",
"question": "Uninstalling a copy: purge its sample rows, or keep them and say so?",
"finding": "The card's premise that a managed uninstall's cleanup purges sample rows does not hold: install-local's uninstall keeps every table and row. A copy is uninstalled through DELETE /api/v1/packages/:baseId; measured on a real boot, it drops the copy's tables with every row by default, and keepData: true keeps every row (sample rows included), which no door can tell apart afterwards.",
"four_axes": "real need: the default leaves no sample row, and only a caller-chosen keepData does; long term: one uninstall semantics, no hidden data delete; AI-safety: a purge inside an uninstall asked to keep data is the silent behaviour the axis warns against; startup focus: no new surface.",
"resolution": "Keep the rows, no code; no field added to deletePackage's answer; the handbook says to purge first. Seat agreed (relay 2026-11-08T11:12Z)."
},
{
"status": "answered_by_seat",
"question": "Seat 3's scope addition: re-record a copy whose record the install did not keep (the store's get answered null on a database error)",
"finding": "The store's get swallows an ordinary driver error and answers null, so the install cannot tell it from no row; the #30808 pin measures it (copyRecord written:false, purge 404), and reseed and count now answer 404 for that copy through the same reader. Neither the base row nor the receipt marks a base as a copy (the import stores no marker), so a re-record from them is a re-record on an id alone.",
"resolution": "Measured and stated in the docblocks; binding left out. Follow-up named for the seat to file: (b) the import answers the base row's version and created_at itself, so the door never re-reads the store at install (metadata-protocol)."
}
],
"security_findings": "none",
"out_of_scope_findings": [
"Follow-up (b) above: importUnmanagedPackage answers the base row's instance stamp (metadata-protocol), removing the install-time null ambiguity."
],
"deviations": "Two merges of origin/main instead of one: #31475 (#30964) landed on marketplace-install-local-plugin.ts and its install-modes test after the first merge (ff76c20) and conflicted; resolved in 6cf7abe by keeping both sides, then build, the whole gate union, the package suite and typecheck were re-run on 6cf7abe; dogfood not re-run (ran green on ff76c20). One docs page beside the expected surface: content/docs/deployment/marketplace-handbook.mdx (step 6), declared on the Skills-docs line. The claim's worktree name is objectstack-issue-31425; this work ran in objectstack-issue-31296 on the claimed branch."
}
Generated by Claude Code