[objectstack-fleet]

Fixes #31021

Clause-②: yes (widening)
Metadata-protocol: semantic
Skills-docs: follow-up #31090

Claim: 6701308503 (File surface amended in review of this PR) · Branch: claude/issue-31021-seed-landed-keys · File surface: the seed loader and its tests, AppPlugin's seed loads, the new platform object sys_seed_landed_key with its registration and the regenerated scripts/platform-object-tenancy-census.json, one changeset, and the three lines the object forces outside the server package trees: the roster line 'sys_seed_landed_key' in PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'] (packages/spec), its ORGANIZATION_OWNERSHIP_INVENTORY row (packages/cli), and its entry in plugin-audit's SKIP_OBJECTS · Spec review: the roster line owes a CONTRACT_REVIEW_TIER review, requested from domain:spec#1

维护者速读

• 改了什么：平台为每个组织记下哪些种子行已经落过地，记录存在新的系统对象 sys_seed_landed_key 里。之后启动或升级重放种子时，被人删掉的种子行不再按新 id 插回来，升级新加的种子行照常插入。
• 为什么改：cloud 实测，用户删掉的示例数据在下次装包或升级时会回来（cloud#3657）。自托管的 objectstack serve 每次启动重放种子，问题一样。平台的问题在平台处理。
• 风险与回滚：只有 AppPlugin 的三条种子加载会读写这份记录（启动种子、按组织重放、dev 热加载），包发布、市场安装、重新灌样例数据等其他入口不变。记录写失败只报一次 error，不影响种子行本身。新对象带来的三行也在本 PR：spec 平台对象名册加一行、CLI 组织归属清单加一行、审计跳过表加一行（记录行不进审计日志）。回滚就是 revert 本 PR，多出的表无害。
• 先看：packages/metadata-protocol/src/seed-loader.ts 的 isWithdrawnRow（不再插回被删的行）、resolveReferenceItem 的 withdrawn 分支（指向被删行的引用不报错）、recordLandedKeys（同一轮写记录）；packages/runtime/src/app-plugin.ts 的 seedLoaderOptionsFor 和 replayer 的 reseed 选项；packages/spec/src/system/constants/platform-object-names.ts 名册那一行。
• 两分钟验证：pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/seed-loader-landed-ids.test.ts -t "31021"，预期 13 条全绿：删掉的行不回来、改过的行不动、升级新行照插、reseed 能恢复、记录按组织分开。
• 需要你做的：无，席位落地（spec 名册那一行由 domain:spec#1 做契约复审）。

What changes

@objectstack/metadata-protocol — SeedLoaderService (src/seed-loader.ts)

• New constructor option landedKeys: 'honour' | 'reseed' on SeedLoaderServiceOptions. A loader built without it reads and writes nothing new, so every other caller behaves as before.
• When it is set, the loader opens a per-load record for the organization the load seeds. That organization is config.organizationId, or the install's sole organization (fallbackOrgId, the single posture's Default Organization on a serve boot). If the load seeds no organization, it keeps no record and says so once at info. If sys_seed_landed_key is not registered, it keeps no record and says so once at warn.
• For an upsert or ignore dataset, the loader records the key of every row the dataset lands, in the same pass that writes it. A landed row is one that was inserted, updated, or matched and left alone. The key is the dataset's externalId field names with the values the row was matched by, JSON-encoded, for example [["name","Acme"]]. JSON keeps the stored key free of the in-memory NUL joiner. An id key is recorded under the AUTHORED id, not the per-organization id a replay may assign ([finding] On a walled showcase deployment every organization/create replays fixed-id sys_business_unit seeds that collide on the global id: 9 SeedLoader errors and an unresolved parent reference per new organization #21665).
• The rule: a keyed row the load cannot find is inserted only when its key never landed in that organization. A recorded key whose row is gone is not inserted again. Such a row is counted as skipped, and one info line per load names how many and on which objects.
• References to a removed row: after every database probe misses, resolveReferenceItem answers withdrawn when the record names the target key as landed. A single link is left unwritten: a matched row keeps what it holds, and a created row lands without the link. A multi-value link keeps the elements that still resolve. A row whose own externalId holds such a reference is withdrawn with it. Nothing is deferred and nothing is reported unresolved, so a replay after a person's delete still reads success: true. Pass 2 settles a deferred element the same way. When the record is in use, the key's own references now resolve before any other reference, so a withdrawn row resolves and defers nothing.
• A record read that fails for any reason other than a missing table propagates, the same as loadExistingRecords. A record write that fails is reported once at error and fails neither the rows nor the load. The next load records every row that is still present.

@objectstack/runtime — AppPlugin (src/app-plugin.ts)

• All three seed loads AppPlugin runs honour the record: the boot (inline) seed that objectstack serve and os start run, the per-organization seed-replayer that hosts and sys_organization insert call, and the dev hot-reload seeder.
• The door for a deliberate re-seed: seed-replayer(organizationId, { reseed: true }). It inserts every missing row, including the ones a person removed, and records them again. A new database starts with an empty record, and deleting an organization cascades its record.

@objectstack/platform-objects — sys_seed_landed_key (src/system/sys-seed-landed-key.object.ts)

• SysSeedLandedKey is organization-owned. Its organization column cascades. It is engine-owned, gated by manage_platform_settings, and has no data API and no lifecycle block, so it is durable. It has one non-unique index on (organization_id, object_name). PlatformObjectsPlugin registers it and the package exports it. scripts/platform-object-tenancy-census.json is regenerated: 97 registered, 50 in reach.

The three lines the object forces

• @objectstack/spec: PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'] lists 'sys_seed_landed_key' in sorted position. PLATFORM_PROVIDED_OBJECT_NAMES and isPlatformProvidedObjectName follow, so a stack that references the object now resolves it instead of drawing the unknown-platform-name advisory. Nothing that was accepted is refused. This follows the sys_lifecycle_state precedent (feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751).
• @objectstack/cli: ORGANIZATION_OWNERSHIP_INVENTORY has a row for the object: census: platform-census-main, fate 3 attribution, anchors: [], cited (in reach, added since the first census) with D10_SINGLE. This is the inventory's disposition for an organization-owned, engine-written table, the same as sys_recycle_bin and sys_connector_connection. The loader writes every row with the organization its load seeds and writes none without one, so a NULL row has no producer, and a key names its seed row by natural key, so no parent row anchors it. The column-drop fate of sys_lifecycle_state applies only to tenant-less tables, and this one is not tenant-less.
• @objectstack/plugin-audit: SKIP_OBJECTS lists 'sys_seed_landed_key' beside sys_lifecycle_state. Recording which seed rows landed writes no sys_audit_log or sys_activity row of its own; the seeded rows themselves stay audited.

Why a new object rather than existing state: no existing platform object fits. sys_setting is the settings K/V store, and its own header refuses internal state. sys_migration and sys_lifecycle_state are deployment-level and tenant-less. sys_metadata_activation is an activation boolean per artifact. sys_recycle_bin is reaped after its retention window, so a removed row would come back after it. The record has to sit in the same database as the rows it describes, scoped by organization. That is why it is not a host seam like the package-state store (#31008).

Tests

New pins and their runs (loader, AppPlugin and object at d1abef0; the three forced lines at 6a1892e)

• packages/metadata-protocol/src/seed-loader-landed-ids.test.ts — a new top-level describe with 13 cases in the existing landed-ids harness. They cover: the key recorded per organization and recorded once; a deleted row not re-inserted by a reboot or by a seed-union change, while the upgrade's new row lands; the same under upsert; an edited row and a renamed key untouched; a reference to a removed row left as it is (single and multi-value, no error, no deferral); a row keyed on a removed row withdrawn with it; the reseed door; isolation between organizations, with a new organization getting the whole seed; an id-keyed row recorded under its authored id; no organization or no registered object keeping no record, saying so once; a loader not asked neither reading nor writing; a failed record write reported once at error with the load succeeding; a failed record read stopping the load.
• packages/runtime/src/app-plugin.seed-landed.test.ts — a new top-level describe with 2 cases. In the first, serve's inline seed with the sole Default Organization keeps a deleted row deleted across a reboot and an upgrade, and the upgrade's new row lands. In the second, the per-organization replayer keeps the record per organization, and { reseed: true } brings the row back.
• packages/platform-objects/src/plugin.test.ts — the registered list now includes the object, and its shape is pinned.
• The roster line is pinned both ways by the existing packages/spec/src/system/constants/platform-object-names.test.ts, and the inventory row by the existing packages/cli/src/utils/organization-ownership-inventory.test.ts, which enumerates that roster.

pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2   → Test Files 321 passed | 4 skipped (325) · Tests 22525 passed | 26 skipped
pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 src/app-plugin.seed-landed.test.ts → Tests 6 passed (6)
pnpm --filter @objectstack/runtime test (merged tree f72ceee6)               → Test Files 553 passed (553) · Tests 8878 passed | 19 skipped
pnpm --filter @objectstack/platform-objects test                             → Test Files 117 passed (117) · Tests 1638 passed
typecheck metadata-protocol / runtime / platform-objects                     → Done ×3

(head 6a1892ec)
pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/system/constants/platform-object-names.test.ts → exit 0 · Tests 14 passed (14)
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 src/utils/organization-ownership-inventory.test.ts → exit 0 · Tests 26 passed (26)
pnpm --filter @objectstack/plugin-audit exec vitest run --maxWorkers=2 src/audit-writers.test.ts src/audit-log-read-visibility.test.ts src/activity-read-visibility.test.ts → exit 0 · Test Files 3 passed · Tests 203 passed
typecheck spec / cli / plugin-audit (NODE_OPTIONS=--max-old-space-size=4096) → exit 0 ×3
pnpm check:platform-object-tenancy-census                                    → exit 0 · 97 objects, 50 in reach, 47 outside

Ablations — each negative pin, old behaviour put back, red, restored (scripts/ablation-replace.mjs, blob == HEAD after each)

#	Mutation (old behaviour)	Result
A1	isWithdrawnRow answers false (a removed row is inserted again)	8 failed / 19 passed (27). Example: expected [ 'Acme', 'Globex' ] to deeply equal [ 'Acme' ]
A2	the record never answers a reference (withdrawn branch deleted)	4 failed / 23 passed. expected false to be true on success: the pass-2 unresolved errors return
A3	recordLandedKeys never called	10 failed / 17 passed
A4	AppPlugin passes no landedKeys	2 failed / 4 passed (6). expected [ 'CASE-1', 'CASE-2' ] to deeply equal [ 'CASE-2' ]
A5	the replayer ignores { reseed: true }	1 failed / 5 passed. expected { inserted: +0, … } to match object { inserted: 1 }
A6	the record is on for a loader that did not ask	1 failed / 26 passed

The loader ablations ran against src (the metadata-protocol tests import ./seed-loader.js). The AppPlugin ablations ran against runtime src/app-plugin.ts. No ablation went through a dist/ build. All six ran at 7a89f01. The lines they mutate are byte-identical at d1abef0.

Acceptance notes

The SKIP_OBJECTS entry has no case of its own. The amended File surface names the line, not audit-writers.test.ts, so no sys_seed_landed_key case was added beside the sys_lifecycle_state one. audit-writers.test.ts and the two read-visibility suites stay green with the entry.

Boundaries, by design:

• Only AppPlugin's loads ask for the record. These doors keep today's behaviour: the package-publish apply (protocol-publish-batch.ts), runtime domains/packages.ts, and cloud-connection install-local's install, heal, reseed and purge. The install-local reseed is the existing "restore sample data" door, and it never reads the record, so it still restores. A row it restores is present, so later replays leave it alone.
• A row deleted BEFORE this lands has no record. The first replay after the upgrade inserts it once more and records it, the same as today. From then on, a delete is remembered.
• A composition with no organization object keeps no record and says so at info.
• A seeded object with tenancy disabled is recorded under the load's organization. An organization that never landed the global row, such as a new organization's first replay, inserts it again.
• Metadata-protocol: semantic: the meaning of an authored mode: 'ignore' or mode: 'upsert' on replay changes. A removed row whose key landed is no longer "a row the dataset is missing". No key is added. The roster line would make the kind added as well, and semantic outranks added. Clause-②: yes (widening): SysSeedLandedKey is a new export of @objectstack/platform-objects, SeedLoaderServiceOptions gains landedKeys, and the platform object roster lists one more real object. There is no new schema option and no new error code. The changeset is minor for every package this diff moves (metadata-protocol, runtime, platform-objects, spec, cli, plugin-audit), because a kind other than none takes minor (AGENTS.md, Post-Task Checklist step 3; feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751's changeset did the same).
• The docs owe a follow-up. content/docs/data-modeling/seed-data.mdx (Import Modes) still says ignore inserts "a record whose row is missing". It should say that a removed seed row is not inserted again, and name the reseed door.
• Hosted: the card's cloud rig reaches the loader through AppPlugin's seed-replayer. This session has no read access to objectstack-ai/cloud, so the ArtifactKernelFactory call site is NOT MEASURED here. packages/cli has no seed call site of its own: serve seeds through AppPlugin, and serve.ts only reads the settlement.

Verification

Gates (derived by dispatch-gates --commands at 6a1892e, exit codes written to disk before any reading)

All 98 derived families were run locally at 6a1892e. dispatch-gates --ran reports 98 derived, 98 run, 0 NOT-MEASURED, 0 UNRUN, and every family exits 0.

• On the first pass of this head, check:dual-build-cjs-loads and check:i18n-coverage exited 3 (PREREQUISITE NOT MET: the worktree held no full build). After turbo run build succeeded (119/119), both exit 0.
• At d1abef0, check:query-options-erasure and check:test-source-alias were real findings, and both were fixed at that head: the ledger read's query bag was typed as EngineQueryOptions, and a module-top import '@objectstack/metadata' was added to the AppPlugin seed test.
• pnpm lint → exit 0 at 6a1892e.

[github-actions]

📓 Docs Drift Check

This PR changes 6 package(s): @objectstack/cli, @objectstack/metadata-protocol, @objectstack/platform-objects, @objectstack/plugin-audit, @objectstack/runtime, @objectstack/spec, touching 40 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/platform-objects/src/system/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

78 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 24bc259363f11c384a5d6ade8da9d497a2c77821.

⛔ 19 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/platform-objects/src/system/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: isSystem (5 routes)
• 2 anchor(s) matched too much of the corpus to be a work list: created_at (literal, 43 pages), organization_id (literal, 39 pages)
• 9 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 226 client-bound route-ledger rows — the other 163 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 163: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 185 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 24bc259363f11c384a5d6ade8da9d497a2c77821 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8fec212c9e593f47af96ba5625c7e51aab992007 — the merge of head 6a1892ec03261c4f9aef1330bb2615d21a54c197 into base 24bc259363f11c384a5d6ade8da9d497a2c77821, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8fec212c9e593f47af96ba5625c7e51aab992007 && git checkout 8fec212c9e593f47af96ba5625c7e51aab992007
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 24bc259363f11c384a5d6ade8da9d497a2c77821 6a1892ec03261c4f9aef1330bb2615d21a54c197 && git checkout -B drift-repro 24bc259363f11c384a5d6ade8da9d497a2c77821 && git merge --no-ff 6a1892ec03261c4f9aef1330bb2615d21a54c197

node scripts/docs-audit/affected-docs.mjs --json 24bc259363f11c384a5d6ade8da9d497a2c77821

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 24bc259363f11c384a5d6ade8da9d497a2c77821 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#1 · sunhaolin · session_017xRBcTJTE7kSbcMoJQ4Txf

Contract-review-handoff: domain:spec#1 — CONTRACT_REVIEW_TIER unavailable (seat slot held: the maintainer's serial order 「当前任务处理完，后续串行」, one agent running for #30803, 2026-11-07T05:23Z) · head 6a1892e

Scope: packages/spec/src/system/constants/platform-object-names.ts (one roster line, 'sys_seed_landed_key') is the face hit, plus the files its hunk makes a claim about: the new packages/platform-objects/src/system/sys-seed-landed-key.object.ts, its registration, the ORGANIZATION_OWNERSHIP_INVENTORY row (fate attribution, not column-drop, because the table is organization-scoped) and plugin-audit's SKIP_OBJECTS entry. Clause-②: yes (widening): SysSeedLandedKey is a new export of @objectstack/platform-objects, and SeedLoaderServiceOptions gains landedKeys. CI on this head: 55 success, 9 skipped, 0 failed. The precedent is #30751 (sys_lifecycle_state, spec consent 6669304514). The lane seat's ACCEPT follows a PASS on this head.

[objectstack-fleet]

domain:spec#1 · os-tesla · session_01L9qibzzqHZdAVqgBAvxXKB

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6a1892ec03261c4f9aef1330bb2615d21a54c197
Local-runs: none
Scope: packages/spec/src/system/constants/platform-object-names.ts + packages/platform-objects/src/system/sys-seed-landed-key.object.ts, packages/platform-objects/src/system/index.ts, packages/platform-objects/src/plugin.ts, packages/platform-objects/src/plugin.test.ts, packages/cli/src/utils/organization-ownership-inventory.ts, packages/plugins/plugin-audit/src/audit-writers.ts, scripts/platform-object-tenancy-census.json, .changeset/seed-landed-keys-31021.md (read for ②); read in the live tree on main: packages/spec/src/system/constants/platform-object-names.test.ts, packages/lint/src/validate-object-references.ts, packages/spec/src/stack.zod.ts, packages/spec/src/data/seed.zod.ts, packages/objectql/src/engine-lifecycle-health.ts, packages/objectql/src/engine-secrets-and-routing.ts, packages/objectql/src/engine-cascade-planning.ts, packages/cli/src/utils/organization-ownership-inventory.test.ts, ui/packages/data-objectstack/src/index.ts, and at the head packages/metadata-protocol/src/seed-loader.ts (the sys_seed_landed_key read and write paths only). The rest of the diff (loader, AppPlugin, their tests) is the server lane's ACCEPT at TIER_DEFAULT.

Inputs: card #31021 body and its 4 comments (triage 6692929632, claim 6701308503 with the amended file surface, os-dev-reports 6702346336 and 6702739093); PR #31083 body, file list and git diff origin/main...6a1892ec (merge base cb8f520, 13 files, +1062 / -14); the check-runs on the head, read once.

Check-runs on 6a1892ec (read once, 2026-11-07): every run completed, none pending, none failed. Push run 42339632913: Test Core 1/8 to 8/8 and the Test Core roll-up success (the spec roster test and the cli inventory test run there), Build Core, Type Check UI, Test UI 1/16 to 16/16, Build and E2E UI, Live E2E UI, Dogfood Regression Gate success. Run 42339632867: Lint and Repo Gates, Lint · ESLint, Lint · docs and code guards, Lint · PM dispatch-gates, Lint · CI, release and engine gates, Lint · scoped (tooling self-tests, query-options erasure, slot lookup and corpus), Type Check · workspace / source gates / consumer gates / debt ledger, TypeScript Type Check success. PR-automation: Check Changeset success (twice, run 42339632854 and the later edited run 42342476182), PR-body guards success (twice), Governed Surface Queue Guard, Check PR Size, Spec property liveness, Flag docs affected by code changes, Auto Label success. Skipped by their own triggers: Build Docs, UI Published Artifacts, Temporal Conformance, Dogfood Verify CLI, Dogfood Regression Gate shards, Packed-tarball smoke, 18.x upgrade harness, Lint UI, Schedule gate.

① Derived judgments

The one hits hunk adds 'sys_seed_landed_key' to PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'], between sys_secret and sys_session. What that line entails, each judged against the live code:

• The roster's own contract — RIGHT. The file header says a group is "the exact set that package registers", and the ratchet platform-object-names.test.ts scans every packages/**/*.object.ts for its ObjectSchema.create({ name }) and asserts equality per owning package, both ways. At the head packages/platform-objects/src/system/sys-seed-landed-key.object.ts declares name: 'sys_seed_landed_key', system/index.ts exports SysSeedLandedKey, and PlatformObjectsPlugin.init lists it in the platform-objects manifest objects: [..., SysRecycleBin, SysSeedLandedKey]; plugin.test.ts pins the registration list and the object's shape. So the name is a real registered platform object, in the right group, in sorted position (the test sorts both sides, so position is tidiness, and it is tidy). The dev measured the ratchet red (1 failed, naming sys_seed_landed_key) before the line and 14 passed after it; CI Test Core confirms the after.
• PLATFORM_PROVIDED_OBJECT_NAMES and isPlatformProvidedObjectName follow — RIGHT, a widening. Accept sets that move, none of which refuses anything it accepted before:
  • @objectstack/lint validate-object-references rung ③ (and the dataset, nav-target, nav-access, translation and email-template-hole rules that share the ladder): a stack reference to sys_seed_landed_key now resolves instead of drawing the OBJECT_REFERENCE_UNREGISTERED_PLATFORM advisory.
  • packages/spec/src/stack.zod.ts :5395: a top-level action whose objectName is sys_seed_landed_key is accepted at parse as a known platform object (the engine attaches it when the object is served; a target no loaded package registers is refused at boot, and this one is registered).
  • ui/packages/data-objectstack missingResources: a 404 on the name is swallowed into an empty result rather than rethrown; consistent with the object's apiEnabled: false, and the same treatment sys_lifecycle_state and sys_recycle_bin get.
  • @objectstack/objectql resolvePrimaryDatasource (availability: a datasource whose driver fails to start pins /api/v1/ready to 503 cluster-wide and is not evicted on delete — one bad tenant datasource drains every LB upstream #13408 criterion): the object now votes. It is registered, carries no lifecycle block so isSystemLedgerObject (lifecycle class in SYSTEM_LEDGER_LIFECYCLE_CLASSES) answers false, and it rides the platform-objects manifest whose defaultDatasource is undefined (pinned by plugin.test.ts: "the eight above must NOT acquire the ledger's routing triple"), so it lands on the datasource the other seven witnesses name. One more witness; no system-objects-split.
  • dangling-reference-audit SECURITY_SURFACE_OBJECTS derives from the plugin-security group alone: unaffected. docs/qa/platform-checklist/areas/platform-core.json :1781 pins sys_metadata_activation once in the roster file: unaffected.
• Public surface of @objectstack/spec — unchanged. No new export; api-surface/system.json and export-origins/system.json record PLATFORM_OBJECTS_BY_PACKAGE (const) as a symbol, not its value, so no regenerated spec artifact is owed (Lint and Repo Gates green on the head agrees).
• Readers that hold a row per roster name, in the same commit — RIGHT:
  • packages/cli ORGANIZATION_OWNERSHIP_INVENTORY: its test enumerates PLATFORM_OBJECTS_BY_PACKAGE ("a platform object without a row reds here, by name"), so the roster line forces the row, and os migrate organization-ownership would refuse the table without it. The row { object: 'sys_seed_landed_key', census: PMAIN, fate: 'attribution', citation: CENSUS_MAIN (in reach, added since the first census); D10_SINGLE, anchors: [] } is the sys_recycle_bin shape, and it is the right fate: the object carries an authored organization_id lookup with tenancy on (the regenerated census reads reach: in, tenantField: organization_id, reasons: []), so sys_lifecycle_state's column-drop (ADR-0131 D7, tenant-less) does not apply; the loader stamps every row with the organization the load seeds and keeps no record when it seeds none (openLandedKeyLedger returns undefined and says so at info), so a NULL row has no producer; a key names its seed row by natural key, not by id, so no parent row anchors it. The test's shape rule "fate 3 names its anchors" is met by anchors: []; 26 passed per the dev, Test Core green.
  • scripts/platform-object-tenancy-census.json: the census script scans packages/**/*.object.ts and does not read the roster, so the roster line makes no claim about it; the regeneration is forced by the object, not the line. Totals 96 to 97 registered, 49 to 50 in reach, 47 outside, reasonTotals unchanged; check:platform-object-tenancy-census exit 0 per the dev's gate run and the repo-gates job.
  • plugin-audit SKIP_OBJECTS (AUDIT_EXCLUDED_OBJECTS is spread from it): not a roster reader; forced by the object being engine-owned bookkeeping written once per landed key. Right on the sys_lifecycle_state and sys_recycle_bin precedent; the seeded rows themselves stay audited. Not pinned by name in audit-writers.test.ts (the dev says so); see ④ should-fix.

② Semver level

• The changeset .changeset/seed-landed-keys-31021.md grades all six packages the diff moves src/** of at minor (metadata-protocol, runtime, platform-objects, spec, cli, plugin-audit) and carries both declaration lines at line start, yes (widening) on the clause line and semantic on the metadata-protocol line; the PR body carries the same two lines. skip-changeset is not in play.
• As scripts/pm/clause2-line.mjs reads them: value yes, arm widening, kind semantic. A well-formed pair: the two refused contradictions are added under no and narrowed without the (narrowing) arm, and neither is here; no (widening) is not here.
• As scripts/check-changeset-no-major.mjs reads them (ruling A, 2026-10-21): the level follows the kind alone. semantic is the "enforce" lane: at least one package whose published source the diff moves must be graded minor or above, and every entry is. A minor on spec, cli or plugin-audit is not refused: the gate refuses none beside a minor, and patch on a moved package under a declared kind; it never refuses a minor under a kind (its own battery: "the kind asks for the grade, it does not refuse the PR"). No authorable-surface/ or authorable-defaults/ shard moves. Check Changeset concluded success on the head, twice.
• Is semantic the right kind for this PR? AGENTS.md Post-Task step 3: a changed meaning or default of what a metadata author writes is semantic; "several ⇒ narrowed over semantic over added". The replay meaning of the authorable SeedSchema.mode values ignore and upsert changes on AppPlugin's loads (a missing keyed row whose key landed in the organization is no longer inserted). The roster line alone is added (feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751 and feat(objectql,platform-objects): keep a by-id delete's rows in the recycle bin (ADR-0148) #30780 declared exactly that for the same one-line shape). Several, so semantic outranks added. Right.
• Is yes (widening) right for the spec face? Yes: ① names the accept sets the line widens (lint rung ③, the stack action target), and nothing is narrowed anywhere under packages/spec, so no (narrowing) arm and no ADR-0087 disposition is owed. For the spec package the level is minor, as the two precedents graded it and as the gate reads it. Right.
• One spec-side residual, outside my hits and outside the amended surface (the claim forbids any other packages/spec/** path): the spec's own published description of mode in packages/spec/src/data/seed.zod.ts (:176-205 and the .describe() text, "a missing row is inserted and an existing row is left as it is") still states the unconditional create-only rule, so the meaning the semantic declaration announces is published nowhere in the spec. The PR already owes content/docs/data-modeling/seed-data.mdx as follow-up docs + skills: teach that a deleted seed row stays deleted (#31021), and fix the stale seed-mode table in the objectstack-data skill #31090; the seed.zod.ts docstring belongs in the same follow-up. Should-fix, carried below.

③ Boundary flags

• Clause and kind corrected in review (dev deviation, round 0 and the claim's correction): yes (widening) and semantic, from the claim's yes and semantic — answered in ②: right.
• spec, cli and plugin-audit at minor, not patch (dev deviation, round 1): answered in ②: right under ruling A and the feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751 / feat(objectql,platform-objects): keep a by-id delete's rows in the recycle bin (ADR-0148) #30780 changesets.
• "Nothing else under packages/spec/**" (claim 6701308503, the amended surface): held. git grep at the head finds the name under packages/spec on the roster line only; the spec diff is that one line.
• The three forced lines landed by option A (round 0 open_questions, one entry): the seat amended the file surface on the claim and asked this review; the lines are in the same commit as the object, as the sys_lifecycle_state precedent and the ratchet require. Answered. Round 1 lists no open question.
• No named pin for the audit skip (dev deviation, round 1): the skip is enforced by set membership and AUDIT_EXCLUDED_OBJECTS is spread from the set; the three audit suites pass with the entry. A pin by name is the sys_lifecycle_state shape; should-fix for the server lane, not a roster matter.
• Docs follow-up docs + skills: teach that a deleted seed row stays deleted (#31021), and fix the stale seed-mode table in the objectstack-data skill #31090 (Skills-docs: line): owed and named; add the seed.zod.ts mode docstring to it (②).
• Hosted ArtifactKernelFactory call site NOT MEASURED (dev, no cloud read access): a cloud carrier (cloud#3657 item 2), outside the spec face; escalated by the dev, nothing for this record to answer.
• The seed doors that do not pass landedKeys still re-insert a removed row (dev out-of-scope finding): not a spec matter; the roster line is indifferent to which loads honour the record.
• ADR check (Prime Directive 13): no ADR fixes the create-only replay rule; it is ruling 6631016988 on [Decision] A restart puts seeded records back: a customer's edit to a seeded row is overwritten by the next boot #30081, recorded in seed.zod.ts, whose point (a replay must not write the shipped value back over a customer's edit) this diff strengthens rather than reverses. ADR-0131: the object is organization-owned with every row stamped by the load's organization, so D7 (deployment-level state, no organization column) does not apply and the D10 fate is 3, not 1; the inventory row says the same. No ADR amendment owed.
• No security finding on the spec face; the object has no data API, is engine-owned and read-gated by manage_platform_settings, a capability the spec already names (eval-user.zod.ts).

④ Design judgment

hits file: packages/spec/src/system/constants/platform-object-names.ts, one line. Judged against the code it cites (the object, its export, its registration) and the scenarios the roster is accepted against (a stack or tool referencing the name; the primary-datasource verdict; the inventory and census enumerations). Each holds (①). Attempts to break it:

1. Is the name a cloud-provided or fixture object the roster should not carry? No: declared under packages/platform-objects/src/, a package with no objectstack.manifest.json listing, under the sys_ prefix; the ratchet's "every registered name carries a reserved platform prefix" and "cloud-only names are not declared here" both hold.
2. Could the new voter split the primary-datasource verdict? No: same manifest as the other seven, defaultDatasource undefined and pinned, no lifecycle block so not a §3.6 ledger. One more witness on the same datasource.
3. Could the roster line make the ownership ceremony refuse the table? No: the inventory row lands in the same commit and the enumeration pin passes.
4. Does the object's claim "Deleting an organization deletes its rows" (object header, changeset) hold for an engine-owned object? outlivesOrganization exempts engine-owned objects from the organization-delete refusal and from set_null clearing only; the cascade walk (engine-cascade-planning.ts :862-882) keeps an authored deleteBehavior: 'cascade' on its own meaning, which is the mechanism sys_recycle_bin relies on under the same managedBy. Holds. plugin.test.ts pins the declaration, not a cascade run.
5. Does the roster now let an author seed the record itself? A dataset over sys_seed_landed_key would resolve at lint rung ③, exactly as one over sys_lifecycle_state or sys_recycle_bin does today; the roster answers "is this name real", not "is it authorable", by design, and the object is engine-owned with no data API. No change asked.
6. Is a spec-side name constant owed, as RECYCLE_BIN_OBJECT is? No: that constant exists because the spec publishes the recycle-bin entry schema; here the spec publishes nothing about the row, and the sys_lifecycle_state precedent spells the name in its writer the same way the loader does. The roster line and plugin.test.ts pin the spelling.

Findings:

• Must-fix: none.
• Should-fix S1 (spec, follow-up docs + skills: teach that a deleted seed row stays deleted (#31021), and fix the stale seed-mode table in the objectstack-data skill #31090): amend the mode docstring and .describe() in packages/spec/src/data/seed.zod.ts so the published meaning of ignore / upsert on replay names the record (a removed row whose key landed in the organization is not inserted again by AppPlugin's loads; the deliberate re-seed is the seed-replayer service with { reseed: true }), beside the content/docs change the PR already owes.
• Should-fix S2 (server lane): one case in packages/plugins/plugin-audit/src/audit-writers.test.ts pinning the sys_seed_landed_key skip by name, beside the sys_lifecycle_state one.
• Should-fix S3 (server lane, optional): a pin that an organization delete cascades into sys_seed_landed_key rows, since the object header and the changeset state it and today only the declaration is pinned.

Implemented-by: claude/issue-31021-seed-landed-keys
Reviewed-by: session_01L9qibzzqHZdAVqgBAvxXKB

VERDICT: PASS

[objectstack-fleet]

domain:server#1 · sunhaolin · session_017xRBcTJTE7kSbcMoJQ4Txf

席位核对

ACCEPT · Head-sha 6a1892ec03261c4f9aef1330bb2615d21a54c197 · read at 2026-11-07T05:35Z

• Shape. Draft into main. The body opens Fixes #31021, then Clause-②: yes (widening), Metadata-protocol: semantic and Skills-docs: follow-up #31090. The changeset carries the clause and kind lines and grades six packages minor. 13 files, +1062/−14, all inside the claim's file surface as amended in 6701308503 (the loader and its test, AppPlugin and its test, the new sys_seed_landed_key object and registration, the regenerated tenancy census, the spec roster line, the CLI inventory row, plugin-audit's SKIP_OBJECTS entry, one changeset).
• Premise measured. On origin/main before dispatch, no landed-key record existed in the loader or runtime. The dev measured that no existing store fits (sys_setting, sys_migration, sys_lifecycle_state, sys_recycle_bin), hence the new object.
• Gate check-runs on this head. 55 success and 9 skipped, none failed or pending, including Lint & Repo Gates, TypeScript Type Check and Test Core, where the spec roster and CLI inventory pins run. mergeable_state is clean. check-governed-merges --pr 31083: NOT governed, 1076 lines ≤ 3000. Generated path scripts/platform-object-tenancy-census.json: origin/main has not touched it (or any other file of this PR) since the merge base cb8f5200, so no regeneration is owed.
• Contract review. The domain:spec#1 record 6702871453 is CONTRACT_REVIEW_TIER, PASS, on this head, with no must-fix. This lane seat's TIER_DEFAULT read of the remainder:
  • The loader skips a missing keyed row only when its key is recorded as landed in this organization and the row is gone (existingRecords does not hold it), so a row an upgrade adds still lands.
  • reseed turns off only the honouring, not the recording.
  • Records are written with isSystem and an explicit organization_id.
  • A write failure is one loud error per load, not silent.
  • A load with no organization or no registered object says so at info / warn and keeps no record.
  • AppPlugin's three loads pass honour; the replayer passes reseed on { reseed: true }.
  • Ablations A1–A6 cover each branch (dev report 6702346336).
• Accepted deviations.
  • spec, cli and plugin-audit are graded minor (the spec record judged it right).
  • The CLI inventory fate is attribution, not column-drop, because the table is organization-scoped.
  • The dev left the PR assignee and the body to the seat; the seat patched the body (Skills-docs: follow-up #31090).
  • S2 (pin the audit skip by name) and S3 (pin the organization-delete cascade) are accepted as not done here: both pin behaviour that the set membership and the deleteBehavior declaration already give, and the spec record rates them should-fix, with S3 optional.
• Out-of-scope dispositions.
  • docs + skills: teach that a deleted seed row stays deleted (#31021), and fix the stale seed-mode table in the objectstack-data skill #31090 carries seed-data.mdx and the stale skills/objectstack-data/references/seeds.md mode table; S1 (the seed.zod.ts mode docstring, spec lane) is added there in a comment.
  • objectstack-ai/cloud#3657 item 2 (wiring hosted "restore sample data" to reseed, and confirming the hosted upgrade replay goes through AppPlugin's seed-replayer) stays with its cloud carrier. NOT MEASURED here: this session cannot read the cloud repo.
  • The seed doors that do not pass landedKeys (package install in runtime/domains/packages.ts, cloud-connection install-local and heal, the publish apply) are an Acceptance note: a read-only inference, not measured, so not a filed card.
• Landing clause. Not governed: ready, then auto-merge. Fixes #31021 closes the card on merge, and the seat strips pm:dispatched in the same stroke as the landing note.

席位意见:可落地。用户删掉的示例数据，之后重放种子(升级、重启、serve)不会再按新 id 插回;要恢复示例数据需显式重新灌入(reseed)。托管端是否也走这条路径未在本会话测量，归 cloud#3657。