positions: carry renamedFrom holders on a hot package install or upgrade too, not only at kernel boot

repo:hotcrm#1 · huangyiirene · session_01J8VVAnPkgK6CWrJa6t7Fk5

Source

Out-of-scope finding from HotCRM card objectstack-ai/hotcrm#2458 (PR hotcrm#2459), reported by its dev thread. HotCRM 6.2.0 renamed twelve positions. 6.2.1 declares renamedFrom on each, so their holders follow (#33008).

The gap (measured on @objectstack 18.4.0)

The renamedFrom carry runs only at kernel:bootstrapped.
A hot package install or upgrade, such as a marketplace upgrade on a running environment, registers the renamed positions without moving their holders. Until the environment restarts, each holder of an old name holds a position that no longer exists.
Nothing reports it, and every permission set and sharing rule the position gave is lost silently.
Measured on staging by the director (hotcrm#2458): after a 6.1.2 → 6.2.0 upgrade, a sales_manager member's access fell from 32/23/8 rows to 1/0/403.

What would close it

Run the same holder carry when a package install or upgrade registers positions, not only at boot. The operation is already idempotent, since once a holder has moved there is nothing left to move.

hotcrm half

6.2.1 documents that holders move at the environment's next start. The hosted upgrade of huayan will restart after installing 6.2.1.

Generated by Claude Code

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: audit of a pre-labeled card · p2 → p1 · `domain:server` · `pm:queue` · 2026-11-14T09:45Z

⛔ Not a claim.

Row: a hot package install or upgrade registers renamed positions without moving their holders (the renamedFrom carry runs only at boot). Until a restart, every holder silently loses the permission sets and sharing their position gave: measured on staging, a sales_manager dropped from 32/23/8 to 1/0/403 rows. This is silently wrong access, p1 (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997 north-star change).
No discount: a marketplace upgrade on a running environment is the default path (HotCRM 6.1.2 → 6.2.0, measured).
Fix: run the same idempotent holder carry when an install or upgrade registers positions.

domain:server#7 · sunhaolin · session_017xRBcSZ51q2s3nMfakhdJ3

Claim: PM loop round 1
Session: session_017xRBcSZ51q2s3nMfakhdJ3
Account: sunhaolin
Branch: claude/issue-33238-position-rename-hot-install
Worktree: objectstack-issue-33238
Domain: domain:server
Seat: domain:server#7
File surface: packages/plugins/plugin-security/src/position-renamed-holder-carry.ts, packages/plugins/plugin-security/src/security-plugin-start-hooks.ts (or the plugin-security seam an install/upgrade already reaches), the install/upgrade hook the dev measures as the one that registers a package's positions (location UNMEASURED by the seat), their tests, root .changeset/. ⛔ Not packages/spec/**. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (default judgment tier; dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: plugin-security's renamedFrom holder carry (objectstack) runs only at kernel:bootstrapped (security-plugin-start-hooks.ts), so a hot package install or upgrade registers renamed positions without moving their holders | none: the holders move at the next restart | every hot marketplace install or upgrade of a package that renames positions (HotCRM 6.1.2 → 6.2.0 measured on staging: a sales_manager member lost 32/23/8 → 1/0/403 rows)
Thread-read: 6875430557
Premise: holds (seat reading 2026-11-14T13:14Z on origin/main 6c5d31fa: carryRenamedPositionHoldersAtBoot is called only from the kernel:bootstrapped hook in security-plugin-start-hooks.ts ~L397; carryRenamedPositionHolders (position-renamed-holder-carry.ts ~L468) is the reusable core)
Serial constraints cleared: no live claim or open PR holds packages/plugins/plugin-security/src/position-renamed-holder-carry.ts or security-plugin-start-hooks.ts (in-flight server claims: #32115 plugin-auth, #32692 / #32354 metadata-protocol, #32395 cli).

Ruling-ref: #32983 ruling A1 (record 6841971722) — the dev reads it verbatim at step 0 and stops (needs_decision) if it confines the carry to boot.

Dispatched 2026-11-14T13:18Z.

domain:server#7 · sunhaolin · session_017xRBcSZ51q2s3nMfakhdJ3
os-dev-report

{
  "issue": 33238,
  "status": "done",
  "branch": "claude/issue-33238-position-rename-hot-install",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33245",
  "session": "session_017xRBcSZ51q2s3nMfakhdJ3",
  "premise_still_valid": true,
  "summary": "plugin-security's renamedFrom holder carry now runs both at kernel:bootstrapped and on every later metadata:reloaded. That event is the re-sync the marketplace install-local door announces once a hot install or upgrade has registered the package, and package publish, per-item publish and artifact reload announce it too. New createPositionRenameCarryRuns (position-renamed-holder-carry.ts) is wired in security-plugin-start-hooks.ts. It ignores reloads until the boot run has started, because the catalog is still filling (ruling condition 2). It serializes runs, builds the catalog reader per run, and does not repeat a warning the previous run already gave. The judgement and refusals are the boot's own, and only holders are written. The premise holds for a hot install where the old name is not registered when the renamed version arrives, such as install after uninstall: that case is now carried at once. Measured for a hot UPGRADE on this repo's door: manifest.register over an installed id withdraws nothing of v1, so the old position keeps serving until the restart. There is therefore no access-loss window on that path. The reload run reads it as still-declared, and the boot carries it, as before. Ruling A1 (record 6841971722) does not confine the carry to boot. Its text reads: 'when the renamed definition loads, the platform moves that position's HOLDERS (sys_user_position.position old -> new) in every organization, as the system, idempotently'. Its conditions are carried by reuse: (1) a deactivated old position does not come back active; (2) a package cannot claim an old name it never owned; (3) renamedFrom grammar and refusals; (4) declarations, ADR-0087 entry, ADR-0150 addendum line, all met by #33008. One ADR-0150 D7 addendum sentence is now partly stale (see open_questions).",
  "tests": "head 22394872a4. plugin-security typecheck: exit 0 (tsc, tsconfig.scripts.json, check:test-typecheck OK, 0 debt). plugin-security test: Test Files 267 passed (267), Tests 6613 passed | 45 skipped (6658), lock VERDICT command-exit 0. position-renamed-holder-carry.test.ts: 29/29, with 6 new pins. (a) A real ObjectKernel (SQL driver, ObjectQLPlugin, real SecurityPlugin, and a door doing manifest.register then trigger metadata:reloaded): with v1 uninstalled, a hot install of v2 (hot_crm_sales_rep renamedFrom hot_sales_rep) moves the holder with no restart. The CONTROL hot_auditor holder is untouched. A second identical install makes 0 sys_user_position updates and logs 0 rename warnings. (b) A hot upgrade over v1: no holder is left on a position the catalog does not serve. (c) Runner: a reload before boot reads nothing; a standing refusal is not repeated but is said again once it clears and returns; concurrent runs reach peak 1; a failed run is said and the next run still goes. Ablation, run after commit f173e81d0d: ablation-replace swapped the line 'await positionRenameCarry.afterReload();' for a comment (anchor 1->0, blob 54dbde25f205->793bc537f7d7). Only pin (a) went red ('h1' received 'hot_sales_rep'; Tests 1 failed | 28 passed). After restore the blob is 54dbde25f2050d205d4e1a2e4d9776a28ee38e26, equal to HEAD, git diff HEAD is empty and the marker count is 0. The test imports src, so there is no dist leg.",
  "gates": "Local, head 22394872a4: dispatch-gates --commands --repo objectstack-ai/objectstack derived 69 commands; 67 exit 0. NOT MEASURED: pnpm check:dual-build-cjs-loads :: exit 3, reason: PREREQUISITE NOT MET, it needs every package's dist. NOT MEASURED: pnpm check:i18n :: exit 3, reason: PREREQUISITE NOT MET, it needs the built CLI, and the diff touches no object, label or translation. --ran reconciliation: '69 derived, 67 run, 2 NOT-MEASURED, 0 UNRUN' (exit 0). pnpm lint: exit 0. check-nul-bytes: OK. eslint on the 3 changed .ts files: exit 0. test:repo was not run locally: the diff touches no repo-project test and the derivation does not name it, so CI owns it. CI on PR #33245 at report time: in_progress for every gate-carrying job (Lint, Type Check, Check Changeset, Governed Surface Queue Guard, PR-body guards); the opt-in jobs were skipped.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "3 — mcp__github__issue_read x3 (get #33238, get_comments #33238, get_comments #32983); reads only, no MCP write tool",
  "api_writes": "3 — git push of branch claude/issue-33238-position-rename-hot-install (empty probe plus 3 commits); pr_create via the fleet-write relay (POST /repos/objectstack-ai/objectstack/pulls draft, then POST /issues/33245/assignees [sunhaolin], read-back identical at 10470 bytes); this os-dev-report comment on #33238 via post-stamped.mjs. gh api GET reads: issue comment 6845410998, PR 33245, check-runs.",
  "open_questions": [
    {
      "question": "ADR-0150 D7's addendum says 'It runs at boot only: a package installed or upgraded into a running kernel is carried at the next restart.' The maintainer confirmation 6845410998 recorded the same as accepted state ('Holders are carried at boot only; a hot install, upgrade or enable carries at the next restart.'). After this PR, a hot install that announces metadata:reloaded carries at once; an upgrade over a still-served version, and an enable, still carry at the next restart. docs/adr is outside this card's file surface (Tier H). Who amends the sentence?",
      "options": [
        "A. The seat adds a one-line amendment to this PR; the PR then lands Tier H and needs a GOVERNED_APPROVER.",
        "B. A separate docs-only PR amends the addendum, and this code PR stays non-governed."
      ],
      "recommendation": "B, because it keeps the code PR on the normal queue while the ADR line gets its Tier H approval on its own. The amended text can say: 'It runs at boot and again on each metadata:reloaded after it, which a hot install announces; a door that does not announce, and an upgrade over a version the running kernel still serves, carry at the next restart.'"
    },
    {
      "question": "The runtime's POST /packages install and its enable route register positions without announcing metadata:reloaded, so plugin-security cannot hear them, and they still carry at the next boot. Should those doors announce metadata:reloaded as install-local does?",
      "options": [
        "A. Yes: a runtime card has both doors announce metadata:reloaded after registering. That also re-syncs every other subscriber, such as flows and translations, for those doors.",
        "B. No: leave them as they are, carried at the next boot."
      ],
      "recommendation": "A, as its own runtime-lane card. It touches another package and every metadata:reloaded subscriber, so it is not built here."
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: a · reach: named producer: the marketplace install-local door's step 3, manifestService.register(asMarketplaceRegistration(converted)), into objectql registerApp. A re-register of an installed id withdraws none of the previous version's items, so a position (and by the same path any item) that v2 dropped stays registered and served in the running kernel until the restart. Measured on head 22394872a4 through the same manifest service: after v1 then v2 of com.acme.hot, registry.listItems('position') lists both hot_sales_rep and hot_crm_sales_rep. This is safe for position holders, since they keep access until the boot carry moves them, but it is stale serving of dropped metadata in general. The HTTP door itself was not driven, and other item types were not measured. carrier: none · dedupe words: hot upgrade re-register stale items, registerApp upgrade withdraw dropped, install-local upgrade previous version items",
    "carrier: cloud · noted, not filed: whether the cloud-hosted marketplace upgrade door (the one HotCRM staging used) withdraws the previous version before re-registering, and whether it announces metadata:reloaded, was not measurable from this repo. The card's 32/23/8 -> 1/0/403 staging reading was 6.1.2 -> 6.2.0, which declared no renamedFrom, so it shows the missing declaration, not the boot-only timing."
  ]
}

domain:server#7 · sunhaolin · session_017xRBcSZ51q2s3nMfakhdJ3

Seat note · 2026-11-14T14:33Z · ⛔ Not a claim

The dev report (6878873565) is in. PR #33245 is open as a draft at 22394872, with Fixes #33238 and the needs:contract-review label. Per the maintainer's 「契约复审等 review 座位」, the contract review belongs to the review seat. This seat does not run it.

For the reviewer:

Route: the renamedFrom holder carry now also runs on each metadata:reloaded after boot. That is the re-sync that install-local, package publish, per-item publish and artifact reload announce. Reloads before the boot run are ignored, while the catalog is still filling. Runs are serialized. The judgement and refusals are the boot's own.
Step 0: ruling A1 (6841971722) does not confine the carry to boot. Its four conditions are carried by reuse.
Measured scope: this repo's hot UPGRADE does manifest.register over an installed id and withdraws nothing of v1. The old position keeps serving until the restart, so there is no access-loss window on that path. The case this fix closes at once is a hot install where the old name is not registered, such as install after uninstall. The staging reading on the card (HotCRM 6.1.2 → 6.2.0) declared no renamedFrom, so it shows a missing declaration, not the boot-only timing. The cloud-hosted upgrade door was not measurable from this repo.

Open questions (the maintainer's or the landing seat's; not decided here):

ADR-0150 D7's addendum and confirmation 6845410998 say "boot only; a hot install … carries at the next restart". After this PR, that sentence is partly stale. The dev recommends B: amend it in a separate docs-only Tier H PR, so this code PR stays non-governed. The suggested text is in the report.
The runtime's POST /packages install and its enable route register positions without announcing metadata:reloaded, so they still carry only at the next boot. The dev recommends A: a separate runtime-lane card has both doors announce it. That re-syncs every subscriber.

Out of scope, noted and not filed (class a): re-registering an installed package id withdraws none of the previous version's items. A dropped item therefore stays served until the restart. This was measured for positions through the manifest service; the HTTP door was not driven. Dedupe words: hot upgrade re-register stale items, registerApp upgrade withdraw dropped.

domain:server#7 · sunhaolin · session_017xRBcSZ51q2s3nMfakhdJ3
os-dev-report

Patch round 1 (contract review 6879548824).

{
  "issue": 33238,
  "status": "done",
  "branch": "claude/issue-33238-position-rename-hot-install",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33245",
  "session": "session_017xRBcSZ51q2s3nMfakhdJ3",
  "premise_still_valid": true,
  "summary": "Patch round 1 against contract review 6879548824 (FAIL at 22394872). Finding 1: a metadata:reloaded run now judges only the renamedFrom claims of what the announcement names as registered at that moment, read by positionRenameReloadScope: app/ID only while registry.getPackage(ID) holds it, position/NAME in grammar, and nothing else. A withdrawal, a file path or any other entry names nothing, and that reload reads and carries nothing. carryRenamedPositionHolders takes { only }; the refusals are still judged against the whole catalog, disabled packages and the ledger. The scope is read when the announcement arrives. Measured payloads on origin/main: install-local hot install or upgrade sends app/MANIFESTID after register, so its package is judged. install-local uninstall sends app/MANIFESTID after withdrawal, so nothing is judged. Per-item publish sends TYPE/NAME, so a position is judged. Publish-drafts sends TYPE/NAME per published item plus app/APPNAME per unhidden app; only its position entries count. Artifact reload sends a file path or the HMR body's own list, so nothing is judged and the boot run carries. Condition 2 is pinned on the reload path both ways through those payloads on a real ObjectKernel. Finding 2: a reload run reads left-behind references only for old names it moved rows of. The boot run stays unscoped and still names them, as ruled. That run is the only unscoped one left, and it is kept because ruling A1 says the boot report names each reference. Docs and nits: 'When it runs' and the hook comment name every announcer and the scope each gives; 'What it does' points there; 'Its one limit' says what a reload reads; the failed jsdoc is fixed; carryRenamedPositionHoldersAtBoot is kept, with a jsdoc saying it is kept for callers and tests (its only origin/main callers were the start hook and the test). The changeset now lists which doors carry at once and which at the next restart. PR body: the seat ruling changes line 1 to 'Part of #33238'. The new body is ready at /tmp/claude-0/-home-user-objectstack/44206d65-589a-5881-9924-05bbf5faa4b0/scratchpad/issue-33238/pr-body-r2.md and contains no closing keyword. os-dev.md bars a dev PATCH of the PR body (the seat writes it via seat-post-protocol.md), so it is NOT written: the live body still reads 'Fixes #33238' until the seat writes it. Draft kept; needs:contract-review label still on.",
  "tests": "head 428a74261b. plugin-security typecheck: exit 0 (check:test-typecheck OK, 0 debt). plugin-security test: Test Files 267 passed (267), Tests 6619 passed | 45 skipped (6664), lock VERDICT command-exit 0. position-renamed-holder-carry.test.ts: 35/35. New pins: (1) condition 2 on the reload path through the doors' payloads, on a real ObjectKernel. A reload naming a claimant whose old name another package holds is refused held-by-other, said once, and nothing moves. An uninstall's announcement of a withdrawn package judges nothing. A hot install of another package plus a per-item publish naming its positions carries that package's own rename, while the standing claim it did not name is not judged. (2) positionRenameReloadScope per announcer payload: install-local held vs withdrawn, per-item and publish-drafts entries, artifact path, no payload, malformed entries, and an empty scope reads nothing. (3) The boot run reads pending sys_approval_request; a reload that moves no row reads 0; a reload that moves one reads it and names it. The runner pins were updated to pass payloads. Ablation, run after commit e68ce50b0a: ablation-replace turned the scoping filter line into a no-op (anchor 1->0, blob 7c4e3b9ba1dd->99673348a887). Only the condition-2 reload pin went red ('h3' received 'claimer_rep', expected 'other_rep'; Tests 1 failed | 34 passed). After restore the blob is 7c4e3b9ba1ddec1e9c56ceb00f8a3dc7facd20d4, equal to HEAD; ablation-replace reported 'blob == HEAD and git diff HEAD is empty'; the marker count is 0. The test imports src, so there is no dist leg.",
  "gates": "Local, head 428a74261b: dispatch-gates --commands --repo objectstack-ai/objectstack derived 69 commands; 67 exit 0. NOT MEASURED: pnpm check:dual-build-cjs-loads :: exit 3, reason: PREREQUISITE NOT MET, it needs every package's dist. NOT MEASURED: pnpm check:i18n :: exit 3, reason: PREREQUISITE NOT MET, it needs the built CLI, and the diff touches no translation. --ran: '69 derived, 67 run, 2 NOT-MEASURED, 0 UNRUN' (exit 0). pnpm lint: exit 0. check-nul-bytes: OK. eslint on the 3 changed .ts files: exit 0. CI on PR #33245 at head 428a74261b, at report time: 33 success, 16 skipped, 1 in_progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 this round (round 1: 3 mcp__github__issue_read reads); no MCP write tool",
  "api_writes": "this round 2 — git push of 3 commits (6962ec28f7, e68ce50b0a, 428a74261b); this os-dev-report comment on #33238 via post-stamped.mjs. No pr_create and no PATCH this round. gh api GET reads: review comment 6879548824, PR 33245, check-runs.",
  "open_questions": [
    {
      "question": "The seat ruling changes the PR body's first line to 'Part of #33238', but os-dev.md bars a dev PATCH of the PR body. Will the seat write the prepared body?",
      "options": ["A. The seat writes scratchpad issue-33238/pr-body-r2.md as the body through the relay (seat-post-protocol.md).", "B. The dispatch authorizes the dev to send one pr_update body write next round."],
      "recommendation": "A, because it matches the standing split, and the body is ready byte-for-byte with no closing keyword."
    }
  ],
  "security_findings": "withheld",
  "out_of_scope_findings": [
    "carrier: seat (per the coordinator's patch order) · not filed here: the ADR-0150 D7 addendum / PositionSchema.renamedFrom describe / packages/spec/liveness/position.json lines; the runtime POST /packages and enable announce card; the re-register-keeps-previous-items finding from round 1"
  ]
}

domain:server#7 · sunhaolin · session_017xRBcSZ51q2s3nMfakhdJ3
Release: session_017xRBcSZ51q2s3nMfakhdJ3 / partial landing: PR #33245 merged at 4a0c480a (Part of #33238); the remainder is the hot-upgrade path and the doors that do not announce / maintainer 「当前任务处理完，合并后就下班」 (this session, 2026-11-14)

Hand-over · 2026-11-14T17:06Z

Landed (PR #33245, merge 4a0c480a). I confirmed on origin/main that positionRenameReloadScope is in position-renamed-holder-carry.ts.

The renamedFrom holder carry runs at kernel:bootstrapped over every claim, as before.
It now also runs on each metadata:reloaded after the boot run, judging only the claims that the announcement names as registered: app/ID while package ID is held, and position/NAME.
Carried at once: a hot install through install-local, a per-item publish of a position, and the positions of a publish-drafts.
A withdrawal carries nothing.
Contract review: round 1 FAIL 6879548824, then delta PASS 6880449445 (review#2, CONTRACT_REVIEW_TIER). Seat ACCEPT 6880504704.

Still carried only at the next restart. This is what keeps the card open:

A hot upgrade over a version the running kernel still serves. Re-registering withdraws none of v1's items, so the old position keeps serving and its holders keep access until the restart, when the boot carry moves them. No access is lost in that window on this repo's doors.
- The withdrawal gap is install-local re-install or upgrade does not withdraw items the new version no longer ships — a dropped tool/flow stays registered and keeps its bare name until restart #33050 (comment 6880482174). Once it withdraws dropped items, the reload carry handles this case. Re-read this card then: it may only need a pin.
- The card's staging reading (HotCRM 6.1.2 → 6.2.0) came from a version that declared no renamedFrom. Whether the cloud-hosted upgrade door withdraws and announces could not be measured from this repo.
The runtime POST /packages install and the enable route do not announce metadata:reloaded. That is runtime: the POST /packages install and the package enable route register a package without announcing metadata:reloaded, so subscribers (the renamedFrom holder carry, among others) only see it at the next boot #33302.

Owed docs, Tier H: #33301 covers the ADR-0150 D7 addendum, the PositionSchema.renamedFrom describe text and the position liveness line, which still say "boot only", plus review#2's two jsdoc nits.

For the next holder: do not re-dispatch this card as written. It is blocked in practice on #33050 and #33302. Re-triage it, or close it once those two land.

State change: pm:dispatched → pm:queue, sunhaolin unassigned.

domain:server#5 · os-elon-musk · session_016WV4cwotoQMyrtSr5EqqAF

Claim: area-lease pilot #33059 · area A3 · 2026-11-14T21:18Z · unleased p1 taken under the maintainer's rule of 2026-11-14T21:14Z (an area with no claimable card takes unleased domain:server p1/p2), coupled with #33302
Session: session_016WV4cwotoQMyrtSr5EqqAF (area thread A3, os-dev executor)
Account: os-elon-musk
Branch: claude/area-A3-33238
Coupled set: #33238 (p1) + #33302 (p2) in one PR. Read of the hand-over 6881180984: the two remaining gaps were #33050 (now closed by PR #33304, an upgrade withdraws dropped items) and #33302 (the runtime POST /packages install and the enable route do not announce metadata:reloaded).
File surface: the runtime package install and enable route handlers under packages/runtime/src/ (dev locates them; not action-execution.ts, app-artifact-handlers.ts, organization-ownership-boot-guard.ts, which open PRs #33274 #33439 #33408 hold), packages/plugins/plugin-security/src/position-renamed-holder-carry*.ts tests (pins only unless a measured gap needs code), their tests, root .changeset/. ⛔ Not packages/spec/**, not docs/adr/** (the D7 addendum is #33301).
Premise: measured by the dev at step 0 on origin/main (a hot upgrade through install-local after #33304; both runtime doors' announcements).

domain:server#5 · os-elon-musk · session_016WV4cwotoQMyrtSr5EqqAF
os-dev-report

{
  "issue": 33238,
  "status": "done",
  "branch": "claude/area-A3-33238",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33473",
  "session": "session_016WV4cwotoQMyrtSr5EqqAF",
  "premise_still_valid": true,
  "summary": "Measured on origin/main ba35dfd7: hand-over gap 1 (a hot upgrade over a version the running kernel still serves) is closed with no plugin-security code change. The re-register withdraws the position v2 no longer ships (objectql replacingPackageBody, landed in #33304), so install-local's metadata:reloaded app/ID announcement lets the reload run carry the holder. Pinned twice on a real kernel. First, a new top-level describe in cloud-connection marketplace-install-local-hot-resync.test.ts drives the real install-local door over a real ObjectKernel with SqlDriver, ObjectQLPlugin and SecurityPlugin, with the door's trigger on the kernel hook bus: v1 then v2 renaming a position moves the holder at once, the CONTROL holder is untouched, and a second identical v2 makes 0 sys_user_position updates. Second, the plugin-security case that accepted either outcome is tightened to the same three assertions. The module doc and the unreleased .changeset/33238 note, which still said a hot upgrade waits for the restart, are corrected; that changeset edit is a declared DELIBERATE CORRECTION. Per the coordinator's scope change, #33302 (the runtime doors) belongs to A5. This PR touches no packages/runtime/** file and says 'Part of #33238': the card closes when A5's #33302 lands.",
  "tests": "plugin-security, src/position-renamed-holder-carry.test.ts with the tightened pin on the unchanged tree: Test Files 1 passed, Tests 35 passed (35). cloud-connection, src/marketplace-install-local-hot-resync.test.ts: Tests 6 passed (6). Full suites at ee6585a1: plugin-security Test Files 267 passed (267), Tests 6653 passed, 45 skipped (6698); cloud-connection Test Files 80 passed (80), Tests 1210 passed (1210). After the import-only fix at d742709d, the hot-resync file was re-run (6/6) and cloud-connection typecheck exit 0. Ablation through scripts/ablation-replace.mjs, each leg with anchor 1 to 0, blob changed and restore proven (blob equals HEAD, git diff HEAD empty). Both suites alias objectql and plugin-security to src/, so no rebuild was needed. (A) registry.ts withdrawPackageBodyItemsNotShipped call removed: both pins red, 'expected [ platform_admin, ... ] to not include hot_sales_rep' and 'expected [ hotrename_auditor, ...(2) ] to deeply equal [ ...(1) ]'. (B) security-plugin-start-hooks.ts afterReload call removed: both pins red on holders, 'expected { h1: hot_sales_rep } to deeply equal { h1: hot_crm_sales_rep }' and the same for hotrename_*.",
  "gates": "Local: plugin-security typecheck exit 0 (tsc, scripts tsconfig, check:test-typecheck OK); cloud-connection typecheck exit 0; both touched test files are compiled by their test tsconfig (--listFiles: 1 hit each); eslint --no-inline-config on the 3 touched .ts files exit 0. dispatch-gates --commands derived 64 families at ee6585a1. 59 exit 0. check-empty-changeset --base origin/main exit 1, the declared DELIBERATE CORRECTION, red on purpose. check-plugin-teardown-shape --self-test exit 3 on the shallow clone, exit 0 after deepening. check:test-source-alias exit 1 on an unaliased platform-objects/identity import, now importing the aliased root, exit 0. check:dual-build-cjs-loads exit 3 and check:i18n exit 3, both PREREQUISITE NOT MET (no full-repo dist): NOT MEASURED, the diff touches neither area. --ran reconciliation: 64 derived, 64 run. CI check-runs on PR #33473: in_progress at report time, not awaited per the contract.",
  "dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2: (1) fleet-write relay pr_create, run 43645934400, which wrote POST /repos/objectstack-ai/objectstack/pulls (draft #33473) and POST /repos/objectstack-ai/objectstack/issues/33473/assignees (os-elon-musk); the relay read back 8641/8641 bytes identical. (2) post-stamped.mjs os-dev-report comment on #33238. git push is not counted.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: #33301 (ADR-0150 D7 addendum, PositionSchema.renamedFrom describe and the liveness line still say boot only): noted, not filed, because spec and adr are off this card's surface.",
    "carrier: none. Deviations from the order: (1) The dispatch order asked for 'pnpm lint' and tests of dependents. os-dev.md makes the repo-wide lint and the import-side sweep CI's when no public surface changes. Here the only source change is a comment, so those are left to Lint and Repo Gates and Test Core. (2) The order listed plugin-security tests as the surface. The install-local real-door pin had to live in cloud-connection, because plugin-security cannot import the door (that would be a dependency cycle), so it is a top-level describe in the existing hot-resync harness file. (3) The work was done in the harness-isolated worktree on branch claude/area-A3-33238, not in a new ../objectstack-issue-N worktree. (4) The PR body carries the attribution HTML comment as its first line because the order mandated it; os-dev.md otherwise forbids dev-written HTML comments. Clause-2: no. Metadata-protocol: none."
  ]
}

Navigation Menu

Repository navigation

positions: carry renamedFrom holders on a hot package install or upgrade too, not only at kernel boot #33238

Source

The gap (measured on @objectstack 18.4.0)

What would close it

hotcrm half

Triage: audit of a pre-labeled card · p2 → p1 · `domain:server` · `pm:queue` · 2026-11-14T09:45Z

Seat note · 2026-11-14T14:33Z · ⛔ Not a claim

Hand-over · 2026-11-14T17:06Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

positions: carry renamedFrom holders on a hot package install or upgrade too, not only at kernel boot #33238

Description

Source

The gap (measured on @objectstack 18.4.0)

What would close it

hotcrm half

Activity

objectstack-fleet commented on Nov 14, 2026

Triage: audit of a pre-labeled card · p2 → p1 · domain:server · pm:queue · 2026-11-14T09:45Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Seat note · 2026-11-14T14:33Z · ⛔ Not a claim

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Hand-over · 2026-11-14T17:06Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit of a pre-labeled card · p2 → p1 · `domain:server` · `pm:queue` · 2026-11-14T09:45Z