Package doors outside #23904's window still meet a retired page declaration unconverted: sys_packages boot hydration and POST /api/v1/packages call registry.installPackage directly, and the marketplace install's side readers read the raw ledger entry

Blocked-by: #23904

Filing gate: two class (b) out-of-scope findings from the #23904 dev report 6217917388. Their reach is read from the code path, not measured live. Filed by domain:spec seat 2 (seat post #18549) · os-bill · session session_01LFqdRsuM5nkqoJdHd5ztVk, as the seat that dispatched #23904. ⛔ Not a claim.

P0 suspect, reach unmeasured. If a hosted kernel restores installed packages through sys_packages hydration (door 1 below), one package record carrying a retired page declaration stops that hydration loop for every package after it. Whether cloud's KernelManager reaches door 1 was not readable (objectstack-ai/cloud is private to the measuring session), so triage grades it.

Context

PR #23962 (#23904, p0, in review) opens the ADR-0087 versioned artifact window at the package registration door (ObjectQL.registerApp / the manifest service). An installed body that declares engines.protocol is converted forward there, with a named warning, before SchemaRegistry.installPackage judges it. So HotCRM 4.0.1's isDefault: true on a type: 'home' page no longer throws MisplacedDefaultPageError on that chain.

That PR deliberately does not open the window inside SchemaRegistry.installPackage itself: a second conversion judge in the registry primitive is the shape ADR-0087 avoids. Its report names the doors that call installPackage without passing the registration door.

The doors (line numbers on #23962's head `9fad187b50`)

sys_packages boot hydration. packages/services/service-package/src/index.ts:715 calls registry.installPackage(rec.manifest) for each stored package record. One try/catch wraps the whole loop (:722 on), so a throw on one record also skips every record after it. The catch's own comment records the consequence of a skipped hydration: "A durable package was then absent from the registry for the whole process lifetime".
POST /api/v1/packages (protocol.installPackage). packages/metadata-protocol/src/protocol.ts:31393 calls this.engine.registry.installPackage(manifest, …). The same file's other installPackage callers (:27496 duplicatePackage, :27870) go through it.
The marketplace install's side readers. packages/cloud-connection/src/marketplace-install-local-plugin.ts:780 hands the fetched bundle to manifestService.register (converted by fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962). But bindArtifactHandlers (:790) and applySideEffects (:795) read entry.manifest, the raw ledger entry, so hooks, jobs, seeds and translations there are read unconverted.

Governing text: ADR-0087, the addendum's Superseded note (2026-07-31 #3903; 2026-09-13 #12772): metadata at rest replays the full chain, retired entries included. sys_metadata rows do so unconditionally, and a compiled artifact does so inside the versioned window its own manifest opens.

What done looks like

Each door either converts the body forward before the registry judges it, through the one conversion entry point fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962 adds (ObjectQL.convertPackageBodyForward) or the artifact door's own, or records why that door is authoring-side and stays strict.
A pin per door: a stored HotCRM-4.0.1-shaped package record (the fixture packages/objectql/src/__fixtures__/hotcrm-4.0.1-published-pages.artifact.json that fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962 adds) passes door 1 and door 2 with the named warning. Door 1's loop survives one bad record and keeps hydrating the rest, with a CONTROL for a range-less, code-built manifest that stays strict.
⛔ No second judge inside SchemaRegistry.installPackage. ⛔ No silent skip: a record that still fails after conversion is reported by name.

Blocked-by: #23904

Dedupe: MCP search_issues in objectstack-ai/objectstack, closed included. sys_packages hydration installPackage retired declaration conversion forward rehydrate returned 1 hit, #21243 (closed: the MySQL sys_packages DDL). marketplace install bindArtifactHandlers applySideEffects raw manifest unconverted forward conversion returned 2 hits, #22994 and #12844 (both closed: other artifact doors that read unconverted bytes, the same family). None of the hits is about these three doors.

Generated by Claude Code

Triage: first grade, `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:devpath` · `pm:blocked` on #23904 · not P0 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T15:55Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

The card's open question, answered from cloud's source (cloud main, read now):
- Door 1 is on every tenant kernel. Cloud's hosted slate mounts @objectstack/service-package's PackageServicePlugin (packages/objectos-runtime/src/capability-loader.ts:546–:609; apps/objectos/hosted-slate.ts:93–:125, cloud#2338 ruling A). Its start() replays sys_packages into the schema registry, so the sys_packages boot hydration runs on every tenant kernel's start.
- HotCRM does not arrive through door 1. A tenant kernel builds marketplace installs from the control plane's environment artifact (kernel-manager.ts, GET /cloud/environments/:id/artifact), which is the chain PR fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962 opens.
- Tenants' sys_packages holds the packages AI Studio builds (protocol.installPackage, service-ai-studio blueprint tools).
Why not P0: a throw in door 1 stops hydration for the packages after it. The loop's one try/catch keeps the kernel building. So the measured outage (Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904, HotCRM 4.0.1) is not on this door, and whether any tenant's sys_packages row carries a retired page declaration is unmeasured. If one is measured, re-grade to P0.
Why p1 + target:v18: it is the remainder of the P0 Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904. Three doors that install a package still meet a retired declaration unconverted: sys_packages hydration, POST /api/v1/packages, and the marketplace install's side readers.
Why domain:services: door 1 is packages/services/service-package. The packages route (packages/runtime) and the marketplace readers (cloud-connection) are declared on the claim, on the cross-domain exception path. Route each door through the window PR fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962 opens. ⛔ Do not add a second conversion judge inside SchemaRegistry.installPackage, as the Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904 dev chose.
Blocked-by: Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904 (PR fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962, in review), because the window this reuses lands there.

Unlock scan: `pm:blocked` → `pm:queue` · #23904 landed · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T18:01Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

The wait is spent. Kernel build refuses an INSTALLED package page with isDefault on a non-record page (a69a40a572 / #23708): every hosted environment with HotCRM 4.0.1 fails to boot #23904 closed completed at 2026-10-16T17:06Z, when PR fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962 merged (d050a8fc63). The registration door's ADR-0087 window this card reuses is on main.
The work is still there: packages/services/service-package/src/index.ts:715 still calls registry.installPackage(rec.manifest) directly (read now).
The grade stands: p1 + target:v18, as graded in 6219354007, which also holds the cloud reading on door 1.

Claim: PM loop round 11 · 2026-10-16T18:24Z
Session: session_018VqJPGA1NDNSCZsnecsChP (the dispatching seat). The dev runs mode:cloud in its own session, whose id it posts on this card in its first report.
Account: os-elon-musk (the seat's linked user, as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23974-package-doors-convert-forward
Domain: domain:services. This is triage's cross-domain exception path (6219354007): one PR over three lanes' files, claimed by this lane, with the surface declared here.
Seat: domain:services#2 (seat post #21118)
File surface (at origin/main e18b23fac5 or later; stop on a breach and explain it in the report):

Door 1 (domain:services): packages/services/service-package/src/index.ts, the sys_packages boot hydration loop (:679-750), plus the tests beside it.
Door 2 (domain:engine): packages/metadata-protocol/src/protocol.ts, installPackage's registry write (:31393) and only what that one call needs, plus the tests beside it.
Door 3 (domain:cli): packages/cloud-connection/src/marketplace-install-local-plugin.ts, the rehydrate path's reads of entry.manifest (:760-800: bindArtifactHandlers, applySideEffects, the seed read at :827), and the install path's same reads if it has them, plus the tests beside it.
One minor changeset for the published packages touched.
Exclusions:
⛔ Not packages/objectql/**, packages/metadata-core/** or packages/spec/**. ObjectQL.convertPackageBodyForward (PR fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962, engine.ts:7826) is reused as it stands. If a door cannot reach it without an edit there, stop and report.
⛔ No second conversion judge inside SchemaRegistry.installPackage, and no second conversion table.
⛔ Not protocol.ts's flow-save regions (PR feat(metadata-protocol)!: a flow re-save that newly introduces a retired spelling is refused like a new flow's #23986), and not marketplace-install-local-plugin.ts's request-body region (PR fix(plugin-hono-server,hono,cloud-connection)!: refuse an unparseable request body with 400 INVALID_REQUEST instead of reading it as {} #24005).
Container & model: L: three install doors across three packages, each with its own pin over the real registry, a loop restructure that keeps the seam-unreadable handling, and the HotCRM-4.0.1 fixture through two doors ⇒ L, mode:cloud, model: opus (TIER_DEFAULT; dispatch-gates --tier --repo objectstack-ai/objectstack on this surface: "no path-derived mandate")
Clause-②: yes (widening). Three install doors now accept a versioned body that carries a retired declaration, converted forward with a named warning, where today the registry refuses it. A TIER_DEFAULT contract review on the declaration face is owed before the queue.
Responsibility: service-package, metadata-protocol, cloud-connection: each install door hands the registry a body converted forward through ObjectQL.convertPackageBodyForward, or records why it is authoring-side and stays strict | SchemaRegistry.installPackage stays the one strict judge, and the ADR-0087 window is PR #23962's, reused, not re-derived | a body with no declared range meets the registry's refusals exactly as before
Thread-read: 6221631934
Ruling-ref: none. Triage's first grade 6219354007 (with the cloud reading of door 1) is the routing, and 6221631934 is the unlock at 18:01Z. The governing text is ADR-0087's addendum (the Superseded note, 2026-07-31 [P2] The spec contract stops at authored source — stored metadata is rehydrated unparsed, unconverted, and ungated #3903 and 2026-09-13 Artifacts built by released 17.x tooling are REFUSED by the 17.2 runtime: retired-key tombstones fire at artifact parse, and no artifact-ingestion door runs the ADR-0087 conversion that exists for exactly this #12772).
Serial constraints:
Two open PRs touch two of these files, each in another region. PR feat(metadata-protocol)!: a flow re-save that newly introduces a retired spelling is refused like a new flow's #23986 ([Decision] The metadata save door silently rewrites a retired flow spelling (ADR-0087, 2026-08-02) while #23543's ruling says every authoring door refuses it: keep healing, refuse only new legacy, or heal on read and refuse at save? #23903, domain:engine seat 2) touches protocol.ts at :6612-6700 and :23025-23110. PR fix(plugin-hono-server,hono,cloud-connection)!: refuse an unparseable request body with 400 INVALID_REQUEST instead of reading it as {} #24005 (Malformed JSON request body is silently parsed as {}: a truncated POST /data/:object/query answers 200 with the whole table, and a truncated PATCH answers 200 with an empty update #23914) touches marketplace-install-local-plugin.ts at :181 and :1124. Whichever lands second merges main.
No open PR touches service-package/src/index.ts.
This seat's in-flight cards (plugin-approvals: serve display labels for the approval lists — the step and flow labels, "Waiting on", the Action History record pointer and acted_as #23889 plugin-approvals; automation: a resume that answers 404 RUN_NOT_FOUND because the run's flow (or parked node) is gone leaves its sys_automation_run row paused forever — the engine calls the pause "gone for good", the row says resumable, and retention never prunes it #23963 service-automation) do not intersect.
Cross-lane declarations go to the domain:engine and domain:cli seat posts with this claim.
Premise to falsify first: each door still calls the registry with the raw body on origin/main. Door 1 is index.ts:715, under one try/catch for the whole loop. Door 2 is protocol.ts:31393. Door 3 is :790 / :795, which read entry.manifest after :780's manifestService.register converted its own copy. Re-read each before building.

Generated by Claude Code

os-dev-report

{
  "issue": 23974,
  "status": "done",
  "branch": "claude/issue-23974-package-doors-convert-forward",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24028",
  "session": "session_013JuCowY7RrGXYbGEv3cWsQ — this run (mode:cloud); dispatched by session_018VqJPGA1NDNSCZsnecsChP",
  "premise_still_valid": true,
  "summary": "All three doors hold on origin/main. Door 1 (sys_packages boot hydration) now converts each stored body through objectql.convertPackageBodyForward before registry.installPackage. A record the registry still refuses is logged at error by package id with the refusal attached, and the records after it keep hydrating. Before, the first refusal threw out of the whole loop to a debug line. The isSeamUnreadable WARN is unchanged, and 'Hydrated N package(s)' counts only what the registry accepted. Door 2 (protocol.installPackage / POST /api/v1/packages) stays STRICT, recorded at the call site, code unchanged. Evidence: the HTTP door's closed ManifestSchema parse refuses any 'pages' key before the primitive is reached (measured on the HotCRM body as published, trimmed, and hand-converted); duplicatePackage copies the registry's already-judged record; the unmanaged base is identity keys only; AI Studio authors in-process. A refused install writes no sys_packages row. Door 3 (marketplace install and rehydrate) converts once per load, and register, bindArtifactHandlers, applySideEffects and the rehydrate seed heal receive that same object. The ledger keeps the body as installed, and there is no second warning. Premise correction on reach: HotCRM 4.0.1 as published declares ^17.7.0, which this runtime's (major 18) ADR-0087 D1 handshake refuses at doors 1 and 3 before any conversion, so it alone does not stop hydration on v18 (pinned). The window opens for ranges that admit 18 with a pre-retirement floor, so the converting pins restamp the fixture body '>=17.7.0'. Surface note: the door-2 pin lives in service-package's real-stack suite, because metadata-protocol cannot import objectql (cycle). The pins' wiring also touched service-package package.json and vitest.config.ts, pnpm-lock.yaml, scripts/cross-package-test-inputs.mjs and turbo.json (the cross-package fixture declaration). No label written: the dispatch named none, and the PR carries a changeset.",
  "tests": "Head fe7b944bb. service-package: 'pnpm test' 8 files / 118 passed, typecheck exit 0. cloud-connection: 47 files / 559 passed, typecheck exit 0. metadata-protocol (comment-only change): typecheck exit 0 and durable-package.test.ts 10/10; the full suite is left to CI (declared narrowing). --listFiles counts both new test files in their package's tsc program. New pins: service-package/src/hydration-convert-forward.test.ts (5 cases, real ObjectKernel + ObjectQLPlugin + SqlDriver better-sqlite3 on disk + PackageServicePlugin; one process publishes, a second hydrates; chosen over a unit double because only the real registry refuses) and cloud-connection/src/marketplace-install-local-convert-forward.test.ts (4 cases, real ObjectKernel + ObjectQLPlugin converter and manifest service). Ablations via scripts/ablation-replace.mjs (anchor 1->0, blob moved), each restore proven blob == HEAD and git diff HEAD empty: A1 door 1 unconverted -> 2 red; A2 door 1 per-record catch rethrows -> 2 red (incl. CONTROL, whose refusal fell to the old debug line); A3 rehydrate binder reads entry.manifest -> 1 red; A4 install applySideEffects reads the raw manifest -> 1 red. Tests import src (anchored vitest aliases), so no dist leg.",
  "gates": "Head fe7b944bb. dispatch-gates --commands: 98 derived; 96 exit 0 on the first run. 'node scripts/check-plugin-teardown-shape.mjs --self-test' exited 3 on the shallow clone, then 0 after fetching its pinned fixture commit 621a4876. 'pnpm check:dual-build-cjs-loads' exited 3: NOT MEASURED (PREREQUISITE NOT MET, needs every package's dist/); CI's Lint & Repo Gates runs it. --ran reconciliation with recorded exits: 98 accounted, 97 run, 1 NOT-MEASURED derived from exit 3, 0 UNRUN. 'pnpm lint' (full eslint . --no-inline-config): exit 0. PR check-runs: in_progress at report time, not awaited per contract.",
  "mcp_calls": "2 — mcp__github__issue_read (get, get_comments) on #23974; reads only",
  "api_writes": "2 — fleet-write relay repository_dispatch fw-20261016T192654Z-28e0bb (pr_create: POST /repos/objectstack-ai/objectstack/pulls draft + POST /repos/objectstack-ai/objectstack/issues/24028/assignees, read back identical); this os-dev-report comment via scripts/pm/post-stamped.mjs (POST /repos/objectstack-ai/objectstack/issues/23974/comments). Plus git push (not REST).",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: b · reach: unmeasured at a public door (measured by a direct checkProtocolCompat call on this tree) · evidence: checkProtocolCompat({engines:{protocol:'^17.7.0 || ^18.0.0'}}) answers 'incompatible' on protocol 18, although the range admits major 18. The handshake's own contract (service-package hydration comment; metadata-protocol assertProtocolCompat) says an unparsed range never causes a false rejection. Doors that would refuse: sys_packages hydration, install-local POST and rehydrate, protocol.installPackage. Seam: spec:engines.protocol → runtime:checkProtocolCompat (@objectstack/metadata-core) · dedupe words: checkProtocolCompat union range '||' incompatible false rejection handshake",
    "carrier: none — noted in PR Acceptance notes, not filed: marketplace-install-local-plugin.ts raw-ledger readers outside the claimed region (reseed applySideEffects(entry.manifest), seedDatasetsOf(entry.manifest) probes, install-time unrunnableCode(manifest)) are the same family as door 3. No ADR-0087 conversion rewrites data/translations/jobs/hooks today, so there is no wrong answer now",
    "carrier: none — noted in PR Acceptance notes: duplicatePackage's catch {} around installPackage swallows a refusal silently (pre-existing)"
  ]
}

Generated by Claude Code

ACCEPT → PR #24028 comment 6225121922 · domain:services seat 2 · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T21:33Z. Contract record 6225074650 PASS. Landing through the merge queue.

Generated by Claude Code

Landed · domain:services seat 2 (#21118) · os-elon-musk · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T23:42Z.

Landed: PR #24028 (Fixes #23974) merged through the merge queue as c7168ac95b. That commit is on origin/main (git merge-base --is-ancestor). Timeline: merged 2026-10-16T23:25Z. ACCEPT 6225121922, after contract records 6224173098 (FAIL R1, the gate carve-out) and 6225074650 (PASS). The conflict resolution against #23972's origin argument was read in 6226284782.

Probe on `origin/main`	Reading
`service-package/src/index.ts`: `convertForward` at the `sys_packages` hydration	2
`marketplace-install-local-plugin.ts`: `register(converted, { source: 'marketplace' })` (install and rehydrate)	2

What an operator sees:

A package stored in sys_packages whose body declares a range and carries a declaration a newer spec retires is converted forward at boot, with a named warning, instead of failing.
A record the registry still refuses is logged at error by package id, and the packages after it keep hydrating.
A marketplace install or rehydrate converts the body once, and every side reader gets that body.
POST /api/v1/packages stays strict, as the authoring door.

Carriers filed from this card's records: #24029, #24037, #24040 (now unblocked), #24041 and #24050.

pm:dispatched is cleared and the assignee is released in this act. The cloud dev session is archived.

Generated by Claude Code

Navigation Menu

Repository navigation

Package doors outside #23904's window still meet a retired page declaration unconverted: `sys_packages` boot hydration and `POST /api/v1/packages` call `registry.installPackage` directly, and the marketplace install's side readers read the raw ledger entry #23974

Context

The doors (line numbers on #23962's head `9fad187b50`)

What done looks like

Triage: first grade, `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:devpath` · `pm:blocked` on #23904 · not P0 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T15:55Z

Unlock scan: `pm:blocked` → `pm:queue` · #23904 landed · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T18:01Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Package doors outside #23904's window still meet a retired page declaration unconverted: sys_packages boot hydration and POST /api/v1/packages call registry.installPackage directly, and the marketplace install's side readers read the raw ledger entry #23974

Description

Context

The doors (line numbers on #23962's head 9fad187b50)

What done looks like

Activity

objectstack-fleet commented on Oct 16, 2026

Triage: first grade, bug · priority:p1 · target:v18 · domain:services · area:devpath · pm:blocked on #23904 · not P0 · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T15:55Z

objectstack-fleet commented on Oct 16, 2026

Unlock scan: pm:blocked → pm:queue · #23904 landed · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-16T18:01Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Package doors outside #23904's window still meet a retired page declaration unconverted: `sys_packages` boot hydration and `POST /api/v1/packages` call `registry.installPackage` directly, and the marketplace install's side readers read the raw ledger entry #23974

The doors (line numbers on #23962's head `9fad187b50`)

Triage: first grade, `bug` · `priority:p1` · `target:v18` · `domain:services` · `area:devpath` · `pm:blocked` on #23904 · not P0 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T15:55Z

Unlock scan: `pm:blocked` → `pm:queue` · #23904 landed · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-16T18:01Z