metadata: measure the 18.3.0 environment rows that carry the host's stamp in their stored body, and decide whether a stamp-removal migration is owed (follow-up of #32791)

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Follow-up of #32791 (and #32812). Source: #32812's step-0 design and the epic seat's ruling on it. Queued, not dispatched (dispatch is p0/p1 only, ruling 6837849715 on #31527).

What happens

On 18.3.0 the boot priming pass of a host that declares its package wrote the host's stamp back into the stored body of package-less environment rows. On main, bindReadRowPackage (ruling 6809488921) binds such a row's package column to the host on first read. So those existing rows count as the host's items under every design #32812 considered (A, B, main); #32812 changes only rows the pass reads from now on.

Owed

Measure: on an install that ran 18.3.0 with a host declaring its package and a DatabaseLoader, how many environment rows carry the host's stamp, per type, and what each read, write, publish and removal door answers for them after bindReadRowPackage binds them.
Decide whether a stamp-removal migration is owed. A migration changes who owns existing data in live installs, so after measuring, file a needs_decision for the maintainer; do not migrate on this card's own call.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:02Z

⛔ Not a claim; the claim (if any) is unchanged.

Line: installs upgraded from 18.3.0 with a host declaring its package · DatabaseLoader rows · unknown, to be measured · read
Why: Possible ownership misattribution of existing rows is unmeasured; the card is a measurement leading to a maintainer decision, so keep the filed grade.
Rule: the card was filed already carrying a grade and state and had no triage audit; this is that audit, under the adopted grading rules (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997).

Generated by Claude Code

domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw

Maintainer decision 2026-11-14T15:39Z (Elon, decision card; options Fable-reviewed): guard + detector + upgrade note; no ownership-changing migration now.

Measured by area E2 (os-dev): the host stamp was written by every @objectstack/metadata 17.0.0–18.3.0 in the composition MetadataPlugin(packageId) + eager bootstrap without artifactSource + DatabaseLoader; first-party reach 0; cloud not measured. On main over a stamped DB, unregisterPackage(host) deleted 34 of 37 fixture rows (never-stamped control 0); the #32986 guard does not mark these rows because their body already names the host by _packageId.

Do (lease:E2):

Guard (red line, silent data loss): unregisterPackage skips and reports source='database' rows that name the host by body _packageId alone (no packageId/package column), unless the caller passes an explicit force flag; migrateDatabaseLoaderRowPackages leaves the same rows with a new left reason. Check whether bindReadRowPackage can skip stamp-only rows without breaking genuine pre-metadata: the artifact door's memory loader and the database loader keep one row per name, so a slotted type's removed or second holder's item is still served (ADR-0150 D4) #32246 legacy rows — pin it either way. A false positive may leave a host row behind; it must never delete an environment row.
Read-only detector (dry-run report of candidate rows with the evidence).
Upgrade note: affected releases 17.0.0–18.3.0, the composition, symptoms (rows shown as host-owned, phantom 409s, deletion on uninstall before this fix), the manual recipe.
Migration (option A) deferred until a real install reports non-zero rows. Owed separately: check the cloud product's MetadataPlugin config for this composition before any doc says "no first-party reach".

domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw

Note 2026-11-14T15:40Z: this decision supersedes the 2026-11-13 ruling on #33043 (6849626556, "known limitation, no code") for the deletion door only. The guard here is fail-closed (skip + report stamp-only rows), not #33043's route A (history strip) or B (membership by host declaration); those stay deferred with the migration.

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw

Claim: area-lease pilot #33059, area E2 (label lease:E2) · 2026-11-14T18:12Z
Session: session_016WV4cyrFFk86Jqf7Mp5Rzw (area E2 thread)
Account: os-elon-musk
Branch: claude/area-E2-32985
Domain: domain:server
Seat: domain:server#5 (area E2)

fix(metadata): unregisterPackage keeps the rows that name the package…

test(metadata): pin the stamp-only row guard, the boot's skipped bind…

fix(metadata): keep unregisterPackage's contract signature, report th…

test(objectql): force the late-bridge CONTROL whose host row names th…

test(metadata): the detector's read double refuses an operator it doe…

domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw

Seat ruling 2026-11-14T19:48Z (Fable-reviewed) on the two questions from PR #33416:

Column-bound rows (an 18.4.0 boot already bound them to the host): B, as an immediate follow-up PR. The decision's intent is that uninstall never silently deletes an environment row; the "no column" wording predates the 18.4.0 bind. Keep the row unless history shows it was stamped since create; keep on undetermined or a missing history table. fix(metadata)!: unregisterPackage keeps the rows that name the package by the _packageId stamp alone; detector for 17.0.0–18.3.0 stamped environment rows (#32985) #33416 lands first (it also stops the boot bind that moves rows out of reach): change its Fixes #32985 to Refs #32985 and keep this card open for the follow-up.
Wide false positives for non-per-package types: A, keep fail-closed as decided (leftover host rows are accepted). Narrowing by history may ride in the follow-up.

Owed in the follow-up or a docs line: IMetadataService.unregisterPackage(packageName) has no force and no result; a future uninstall UI must call unregisterPackageWithReport and surface kept, or the uninstall looks successful while the package stays live.
Still owed (maintainer side): check the cloud product's MetadataPlugin config for this composition.

Navigation Menu

Repository navigation

metadata: measure the 18.3.0 environment rows that carry the host's stamp in their stored body, and decide whether a stamp-removal migration is owed (follow-up of #32791) #32985

What happens

Owed

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:02Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata: measure the 18.3.0 environment rows that carry the host's stamp in their stored body, and decide whether a stamp-removal migration is owed (follow-up of #32791) #32985

Description

What happens

Owed

Activity

objectstack-fleet commented on Nov 13, 2026

Triage: first-touch audit (pre-labeled card) · p2 confirmed · 2026-11-13T08:02Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:02Z