metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198)

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Follow-up of #32198. Source: #32812's step-0 design and the epic seat's ruling on it (scope B-all held a precondition that measurement refuted, so #32812 stays on the ten package-slotted types and this card takes the rest). Unreleased: #32198 has not shipped.

What happens

On a host that declares its package and wires a DatabaseLoader, the boot priming pass stamps package-less stored rows of the non-package-slotted types (object, view, app, hook, dashboard) with the host's package. Since #32198, unregisterPackage(host) removes by package, so it deletes those rows: the environment's own items are lost when the host package is unregistered. This is on main and survives #32812 (which stops the stamp only for the ten package-slotted types).

Why #32812 does not take it

Not stamping these types moves who owns them: packages/objectql/src/plugin.ts (around L1942, and the reload path around L1865) reads metadataService.getDiagnosed('object', name) and registers the object as a contribution of _packageId ?? 'metadata-service', so an environment object row on such a host registers today as the host package's contribution. #32198's card and PR describe only the package-slotted removal, not a use of the stamp on these types.

Owed

Measure every reader of _packageId / _provenance on these five types on main (the object contribution kind above first) and what each answers for a stamped environment row.
Stop unregisterPackage(host) from deleting environment rows of these types (either stop the stamp with the object-contribution move declared, or keep the stamp and exclude stamped environment rows from the removal); pins red on main, green after; FROM → TO for every moved answer.
Land before the release that would ship metadata: unregisterPackage and unregisterAt remove a slotted type's item by (package, name), match an artifact-door item's _packageId, and name the package on the deleted event (ADR-0150 D4) #32198.

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Claim: PM loop epic round 4
Session: session_01L6bhgWRcTEB3toGxnWvuvX
Account: os-sales
Branch: claude/issue-32986-host-unregister-keeps-env-rows (the card thread's harness branch replaces it by a restated claim)
Worktree: objectstack-issue-32986
Domain: domain:server
Seat: domain:server#4
File surface: packages/metadata/src/** (the boot priming stamp and unregisterPackage removal), packages/objectql/src/plugin.ts (the object contribution owner, read first; edited only if the stamp stops and the move is declared), their tests, .changeset/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high; contract review goes to triage (maintainer rule 2026-11-13 01:13Z)
Clause-②: no (expected: #32198 is unreleased, so no released answer moves; the card thread re-derives after measuring and the seat restates the claim)
Metadata-protocol: none (expected; re-derived after measuring)
Responsibility: objectstack: since #32198 (unreleased) unregisterPackage(host) removes by package and so deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host | the platform path that already covers it: #32812 stops the stamp for the ten package-slotted types only | every host that declares its package and wires a DatabaseLoader; data loss before 18.4.0 ships #32198
Thread-read: none
Premise: re-measured by the card thread on main first (owed item 1: every reader of _packageId / _provenance on these five types, the object contribution kind in packages/objectql/src/plugin.ts near L1942 and the reload path near L1865 first). The object contribution owner (_packageId ?? 'metadata-service') must not move silently.
Serial constraints cleared: #32812 (domain:server#7, claim 6840443478) claims packages/metadata/src/** (boot priming in plugin.ts, metadata-manager.ts, package-slotted-store.ts); no PR yet. The card thread reads #32812's PR before editing; where files intersect this card lands after it and merges main once after it lands. Merge with merge, never rebase. Release line: lands before the release that ships #32198.

Generated by Claude Code

test(metadata): the #32986 pin's stored-row read keeps the test surfa…

domain:server#4 · os-sales · session_01L6bhgThzreKNjha83MypKs
os-dev-report

{
 "issue": 32986,
 "status": "done",
 "branch": "claude/project-thread-im2gsb",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/32999",
 "session": "session_01L6bhgThzreKNjha83MypKs",
 "premise_still_valid": true,
 "summary": "Route chosen: keep the boot pass's host stamp and leave stamped environment rows out of the removal, so the ObjectQL object contribution owner (plugin.ts L1865/L1942, _packageId ?? 'metadata-service') does not move. loadMany records, for every type outside PACKAGE_SLOTTED_STORE_TYPES, the items a datasource loader handed on naming no package (storedEnvironmentRows); unregisterPackage skips such an item when _packageId is its only claim to the package. FROM (main cae2179a) unregisterPackage(HOST) removes the registry entry, deletes the stored row and announces deleted, for object/view/app/hook/dashboard; TO all kept. Unchanged (CONTROLs): the stamp, the host's own stamped-body rows and in-memory items removed, another package's unregister, a host declaring no package. Clause-② re-derived: no (18.3.0 isPackageMember did not read _packageId, #32198 unreleased; the stamp and its readers do not move). Metadata-protocol re-derived: none. Serial: #32812 has no PR; its claimed metadata-manager.ts intersects, so this PR lands after it and merges main once after it lands. Head 426f47c9.",
 "tests": "pin describe [#32986] in packages/metadata/src/loaders/database-loader.test.ts, 4 cases: red on main 2 failed / 2 passed (after-removal assertion; stamp assertion passed), green after. Ablation via scripts/ablation-replace.mjs (fix committed first): delete the isStampedEnvironmentRow guard line, anchor 1->0, blob 2fd11c336850->b18647fd8ed1, 2 failed (both pins) 2 passed (CONTROLs); restore blob == HEAD 2fd11c336850, git diff HEAD empty (suite imports source, no rebuild). pnpm --filter @objectstack/metadata test: Test Files 76/76, Tests 2088/2088 (9a891ae9, closure rebuilt after merge); typecheck exit 0; database-loader.test.ts 275/275 on 426f47c9.",
 "gates": "dispatch-gates --ran: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN, all 64 with exit codes (all 0, derived zero). query-options-erasure first answered 1 on 9a891ae9 (test as any grew test surface 236->237), fixed to as never at 426f47c9; the 11 families reading the test file re-ran on 426f47c9, exit 0. teardown-shape --self-test, dual-build-cjs-loads, lean-entry-closure first exit 3 (shallow clone, partial build), re-ran exit 0 after unshallow + build. Record: /mnt/project-files/server-seat4/32986-gates-ran-426f47c9.txt. CI: in_progress.",
 "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
 "mcp_calls": "5 — issue_read x2, list_pull_requests x1 (reads only); gh search x3",
 "api_writes": "1 relay dispatch (pr_create #32999 with assignee os-sales); this report comment is the second",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: seat · noted, not filed — collectPackageMembers (publishPackage/revertPackage) uses the same isPackageMember, so a stamped environment row is still a member of the host's publish and revert; that rule dates from #22113 (released), not #32198; publish/revert doors refuse non-writable packages first. In the PR's Acceptance notes."
 ]
}

Generated by Claude Code

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Claim: PM loop epic round 4
Session: session_01L6bhgWRcTEB3toGxnWvuvX
Account: os-sales
Branch: claude/project-thread-im2gsb (draft PR #32999)
Worktree: objectstack-issue-32986
Domain: domain:server
Seat: domain:server#4
File surface: packages/metadata/src/** (the boot priming stamp and unregisterPackage removal), packages/objectql/src/plugin.ts (the object contribution owner, read first; edited only if the stamp stops and the move is declared), their tests, .changeset/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high; contract review goes to triage (maintainer rule 2026-11-13 01:13Z)
Clause-②: no (re-derived after measuring: 18.3.0's isPackageMember did not read _packageId, so the released answer is kept)
Metadata-protocol: none (re-derived after measuring)
Responsibility: objectstack: since #32198 (unreleased) unregisterPackage(host) removes by package and so deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host | the platform path that already covers it: #32812 stops the stamp for the ten package-slotted types only | every host that declares its package and wires a DatabaseLoader; data loss before 18.4.0 ships #32198
Thread-read: 6842762319
Premise: re-measured by the card thread on main first (owed item 1: every reader of _packageId / _provenance on these five types, the object contribution kind in packages/objectql/src/plugin.ts near L1942 and the reload path near L1865 first). The object contribution owner (_packageId ?? 'metadata-service') must not move silently.
Serial constraints cleared: #32812 (domain:server#7, claim 6840443478) claims packages/metadata/src/** (boot priming in plugin.ts, metadata-manager.ts, package-slotted-store.ts); no PR yet. The card thread reads #32812's PR before editing; where files intersect this card lands after it and merges main once after it lands. Merge with merge, never rebase. Release line: lands before the release that ships #32198.

Restates: 6841685641 so the claim's own Branch: line names the card thread's branch and the measured Clause-② (same session, same seat; not a second claim).

Generated by Claude Code

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Release blocker for 18.4.0 · p1 → p0 (temporary) · 2026-11-13T03:56Z

⛔ Not a claim; the claim and state are unchanged.

Why it blocks: the loss of the environment's own object, view, app, hook and dashboard definitions when the host package is unregistered is a regression introduced by metadata: unregisterPackage and unregisterAt remove a slotted type's item by (package, name), match an artifact-door item's _packageId, and name the package on the deleted event (ADR-0150 D4) #32198. metadata: unregisterPackage and unregisterAt remove a slotted type's item by (package, name), match an artifact-door item's _packageId, and name the package on the deleted event (ADR-0150 D4) #32198 is unreleased and its changeset is pending, so shipping 18.4.0 as is ships the loss. Unrecoverable loss takes no reach discount (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198) #32986 and metadata: a rewrite that keeps the host's stamp turns an environment row into the host's own, and unregistering the host deletes it again (gates the release shipping #32198) #33003 are the two halves of that one regression: metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198) #32986 is the boot stamp, and metadata: a rewrite that keeps the host's stamp turns an environment row into the host's own, and unregistering the host deletes it again (gates the release shipping #32198) #33003 is the two writes (the late-manifest bridge re-register and restore, and publish/revert) that re-stamp a protected row.
Maintainer (triage#1 session): 「同意」, answering triage's option A: both cards block 18.4.0. Fallback: if metadata: a rewrite that keeps the host's stamp turns an environment row into the host's own, and unregistering the host deletes it again (gates the release shipping #32198) #33003 has no reviewable PR by about 12:00Z, metadata: unregisterPackage and unregisterAt remove a slotted type's item by (package, name), match an artifact-door item's _packageId, and name the package on the deleted event (ADR-0150 D4) #32198 is withdrawn from 18.4.0 (both losses vanish, and that fix ships a release later) rather than moving the cut.
Release practice: p0 for the release window only, with no target: label. It returns to p1 after the release.
State of the fix: PR fix(metadata): unregistering the host package keeps the environment's own object, view, app, hook and dashboard rows #32999 passed its contract review and delta review (a43fc250); merge waits for the remaining Test Core shards.

Generated by Claude Code

Merge origin/main into claude/project-thread-y90728 (#32812)

Navigation Menu

Repository navigation

metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198) #32986

What happens

Why #32812 does not take it

Owed

Release blocker for 18.4.0 · p1 → p0 (temporary) · 2026-11-13T03:56Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198) #32986

Description

What happens

Why #32812 does not take it

Owed

Activity

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Release blocker for 18.4.0 · p1 → p0 (temporary) · 2026-11-13T03:56Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions