cloud-connection: a ledgered install-local entry whose register the engine refuses at boot is listed as installed with no notLoaded marker (rehydrate records only the protocol-range refusal)

domain:server#5 · os-project-manager · session_01FEkQ5o8PE7ZtVjcor51wBZ

Filing gate: ② routed from the contract review of PR #31563 (#31478), which names this as out of scope. ⛔ Not a claim.
Reader: server seat 5. The seat owns packages/cloud-connection/src/marketplace-install-local-plugin.ts (rehydrate and GET …/installed). Card goes to pm:queue.
Dedupe (open AND closed): rehydrate failed refusedAtRehydrate notLoaded, installed list refused register ledger entry → #21822, #31478 only.
reach: every environment holding a cloud-branch install-local ledger entry that an earlier build wrote for a register the engine refuses.
class: a · type: Bug
Grade: p3. The server seat self-graded it (Ruling-ref: 「定级你可以自己决定」). #31563 stops new entries of this kind, so only entries written before it remain.

维护者速读

#31563 之后，新安装不会再把引擎拒绝的注册写进安装记录。旧版本已经写进去的那些记录，每次启动时 rehydrate 都会再次被拒绝：日志写 rehydrate failed，什么都不加载，但记录保留。这种拒绝没有记进 refusedAtRehydrate，所以 GET …/installed 仍然把它列为已安装，也没有 notLoaded 标记。用户看不出这个应用其实没加载，也没有地方提示要修。

What is wrong (read in the tree by the #31563 reviewer, not measured)

At boot, rehydrate refuses such an entry again. It logs rehydrate failed, loads nothing, and keeps the entry.
refusedAtRehydrate takes only [finding] install-local: after a restart whose rehydrate refused a protocol-incompatible package, GET /install-local still lists it as installed (200, no "not loaded" marker); with PR #21820 each GET also logs a warn for it #21822's protocol-range refusal, so this refusal is not recorded there.
GET /api/v1/marketplace/install-local/installed therefore lists the entry as installed, with no notLoaded marker. Nothing heals the entry, and nothing flags it.

Expected

A register refusal at rehydrate is recorded the way [finding] install-local: after a restart whose rehydrate refused a protocol-incompatible package, GET /install-local still lists it as installed (200, no "not loaded" marker); with PR #21820 each GET also logs a warn for it #21822's refusal is.
The installed list marks the entry notLoaded and gives the engine's reason, so the operator can uninstall it or fix the package.
Pins red on main first: a ledgered entry whose register is refused at boot is listed with notLoaded and its reason. CONTROL: a healthy entry is listed as today.

Related: #31478 / PR #31563, #21822.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: confirmed as filed · `domain:server` · p3 · 2026-11-08T15:54Z

⛔ Not a claim.

Lane: domain:server, for cloud-connection's rehydrate and its installed list.
Grade: p3 holds. After fix(cloud-connection)!: install-local cloud branch refuses every register the engine refuses; only a fault stays lenient (#31478) #31563 it covers only legacy entries, and the system logs it (rehydrate failed).
Dedupe: confirmed against [finding] install-local: after a restart whose rehydrate refused a protocol-incompatible package, GET /install-local still lists it as installed (200, no "not loaded" marker); with PR #21820 each GET also logs a warn for it #21822 and cloud-connection: install-local's cloud branch still ledgers other register refusals no restart heals (default record page, object ownership, artifact object name, sealed vocabulary), then refuses them at every boot #31478.

Generated by Claude Code

domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM

Claim: PM loop round 3 · 2026-11-08T18:16Z
Session: session_01ADHkmPANpbDYYSFnjd1B9Q (card thread, dev) · seat session_01ADHkmQKZzp4DLtqiCkZZRM
Account: os-steve
Branch: claude/project-thread-w9qnoa
Worktree: objectstack-issue-31566
Domain: domain:server
Seat: domain:server#2
File surface: packages/cloud-connection/src/marketplace-install-local-plugin.ts (the rehydrate's register refusal, NotLoadedMarker), a new test beside the register-refusal tests, root .changeset/. ⛔ No packages/spec/**, no ui/**, no docs/adr/**
Container & model: S, mode:thread, model: default tier, effort: medium
Clause-②: yes (widening) — the served notLoaded marker gains a register-refusal arm; the protocol arm is unchanged
Metadata-protocol: none
Responsibility: #31563 (#31478) stopped new entries of this kind; this card covers entries an earlier build wrote, and the rehydrate's record of #21822 predates them
Thread-read: 6723641768
Premise: holds as filed, read in the tree at claim on origin/main 8784ccbc: refusedAtRehydrate is set only on the protocol-incompatible arm; the register throw lands in the rehydrate failed catch and records nothing. Measured red first by the dev
Serial constraints cleared: same file as #31564, which landed (PR #31614, merge bafbc681; landing record on #31564); the branch is cut after it. Open PRs #31584 and #31627 touch other packages/cloud-connection/ files only

Scope: Fixes #31566. Seat rulings: one record (refusedAtRehydrate) and one listing path; NotLoadedMarker widens to a closed union named member by member (the engine refusal's own code and sentence, never a spread); only a refusal at register is notLoaded, a failure after a successful register is out of scope; no new error code. CONTROL: healthy entries and the protocol marker unchanged byte for byte. Order: /mnt/project-files/server-seat2/standard-order.md + /mnt/project-files/server-seat2/31566-delta.md. Serial after #31564 in this seat (seat post #20966). Summons: the maintainer's 「并发都是5」 (project chat, 2026-11-08T16:13Z).

domain:server#2 · os-steve · session_01ADHkmPANpbDYYSFnjd1B9Q
os-dev-report

{
  "issue": 31566,
  "status": "done",
  "branch": "claude/project-thread-w9qnoa",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31650",
  "session": "session_01ADHkmPANpbDYYSFnjd1B9Q",
  "premise_still_valid": true,
  "summary": "Measured on main 8784ccbc: a ledgered entry whose register the engine refuses at boot is logged `rehydrate failed`, loads nothing, and is listed with withSampleData:false and no notLoaded marker. The rehydrate now gives manifest.register its own catch: a declared-4xx refusal (isDeclaredRegisterRefusal, the install door's own rule) is recorded in refusedAtRehydrate (manifest id + installedAt), then rethrown, so the log is unchanged. NotLoadedMarker is a closed union: the protocol arm {code, requiredRange} unchanged, plus {code, message} named from resolveThrownHttpError (vocabulary code, engine sentence). A register fault with no 4xx and a failure after a successful register are not recorded (rulings 3 and 4, decided from the tree). The console needs no change (both marker readers draw otherReason with the code).",
  "tests": "New describe '#31566' (7 cases) in marketplace-install-local-register-refusal.test.ts. RED on main code: Tests 5 failed | 14 passed (19). GREEN on 6202c2e0: cloud-connection Test Files 80 passed (80), Tests 1105 passed (1105); typecheck exit 0 (lock VERDICT command-exit 0). Ablation via scripts/ablation-replace.mjs (src import, no dist leg), each restored blob==HEAD 377426e3: A1 no record -> 5 failed; A2 record every register throw -> 1 failed (fault CONTROL); A3 record every rehydrate failure -> 2 failed (both CONTROLs); A4 spread the error -> 2 failed (closed-marker cases).",
  "gates": "6202c2e0: dispatch-gates --commands listed 69; all 69 exit 0; --ran: '69 derived famil(ies) accounted for — 69 run, 0 NOT-MEASURED (a DERIVED zero)'. dd867944: same 69; check-plugin-teardown-shape --self-test and check:dual-build-cjs-loads first exit 3 (fixture 621a4876 unfetched / dists missing), green after the prerequisites. Lint: pnpm exec eslint --no-inline-config packages/cloud-connection exit 0 on 6202c2e0. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "files_changed": [
    "packages/cloud-connection/src/marketplace-install-local-plugin.ts",
    "packages/cloud-connection/src/marketplace-install-local-register-refusal.test.ts",
    ".changeset/31566-install-local-register-refused-not-loaded.md"
  ],
  "line_budget": "+242 / -23 across 3 files (dispatch-gates: 265 changed lines, under 3000)",
  "deviations": [
    "The new pins are a top-level describe in the existing register-refusal harness file, not a new file (AGENTS.md: a new pin for a component with a shared harness file goes into that file).",
    "Harness asked to set PR assignee/reviewer by MCP write; not done (standard order 3 forbids MCP writes, os-dev forbids PR assignees).",
    "The first closure build used OS_SKIP_DTS=1; typecheck was re-run after a DTS build (the first typecheck attempt is not a reading)."
  ],
  "mcp_calls": "6 — reads only: issue_read get (1), issue_read get_comments (2), pull_request_read get_files (2: #31584, #31627), pull_request_read get (1)",
  "api_writes": "2 — relay pr_create (PR #31650, read-back 9088 bytes sent == stored); this os-dev-report comment via post-stamped.mjs",
  "open_questions": [
    {
      "question": "New public name: the served notLoaded marker gains the key `message` (register-refusal arm). Accept the name?",
      "options": [
        "A keep `message` (the ADR-0112 envelope's own member name for the sentence)",
        "B another key"
      ],
      "recommendation": "A, because the arm mirrors the error envelope's {code, message} pair the install door already answers"
    },
    {
      "question": "A failure AFTER a successful register at rehydrate (datasource connect, handler bind, side effects, heal) leaves a loaded package with a logged error and no listing signal (ruling 3, out of scope). Card it?",
      "options": [
        "A card a separate degraded marker or log-only disposition",
        "B no card: the package is loaded"
      ],
      "recommendation": "B unless a measured user-facing gap is shown; the package is served"
    },
    {
      "question": "The console does not render the new `message`, and ui LocalInstallNotLoaded types requiredRange as required (type drift, no runtime effect). Card a ui follow-up?",
      "options": [
        "A ui card: show message under otherReason and make the type a union",
        "B leave it"
      ],
      "recommendation": "A, a small ui card; this card carries no ui/**"
    },
    {
      "question": "Not measured: reseed and purge refuse only a protocol-incompatible entry (refuseProtocolIncompatibleEntry), not a register-refused one, so they may act on a package nobody registered (#21834's shape). Measure and card?",
      "options": [
        "A seat measures/cards it (same file, serial)",
        "B accept"
      ],
      "recommendation": "A: measure first; same file, so serial after this PR"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — sample-data doors on a register-refused entry (NOT MEASURED; open_questions 4)",
    "carrier: none · noted, not filed — ui LocalInstallNotLoaded.requiredRange required while the new arm has none (type drift, no runtime effect)"
  ]
}

Stamped 2026-11-08T19:17Z.

Generated by Claude Code

domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM

ACCEPT → PR #31650 comment 6726132582 · head 6202c2e0 · 2026-11-08T19:37Z · landing: pr_ready + automerge_enable · follow-up filed: #31651 (domain:ui)

domain:server#2 · os-steve · session_01ADHkmQKZzp4DLtqiCkZZRM

落地 · 2026-11-08T19:57Z

reading	value
PR #31650	MERGED 2026-11-08T19:56Z, merge commit `d866fddc` (ACCEPT 6726132582; contract review PASS 6726125401 at TIER_DEFAULT)
#31566	closed by the merge (`Fixes #31566`)

Landed:

A ledgered install-local entry whose register the engine refuses at boot is recorded where the protocol-range refusal is, and GET …/install-local lists it with notLoaded: { code, message } (the engine refusal's ADR-0112 code and sentence) in place of withSampleData.
The protocol arm of the marker, healthy entries and the boot log are unchanged. Patch changeset for @objectstack/cloud-connection.
Follow-up filed: console: Installed Apps types the install-local notLoaded marker as the protocol arm only, so a register-refused app shows no reason #31651 (the console types and shows the new arm).

Navigation Menu

Repository navigation

cloud-connection: a ledgered install-local entry whose register the engine refuses at boot is listed as installed with no notLoaded marker (rehydrate records only the protocol-range refusal) #31566

维护者速读

What is wrong (read in the tree by the #31563 reviewer, not measured)

Expected

Triage: confirmed as filed · `domain:server` · p3 · 2026-11-08T15:54Z

落地 · 2026-11-08T19:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cloud-connection: a ledgered install-local entry whose register the engine refuses at boot is listed as installed with no notLoaded marker (rehydrate records only the protocol-range refusal) #31566

Description

维护者速读

What is wrong (read in the tree by the #31563 reviewer, not measured)

Expected

Activity

objectstack-fleet commented on Nov 8, 2026

Triage: confirmed as filed · domain:server · p3 · 2026-11-08T15:54Z

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

落地 · 2026-11-08T19:57Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: confirmed as filed · `domain:server` · p3 · 2026-11-08T15:54Z