Repository navigation
install-local: the boot rehydrate judges a ledger entry in the CLI's lifted shape unflattened, so a pre-fix install with an excluded engines.protocol re-registers unchecked (#28535) #28604
Description
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Filing gate: ① class (a) out-of-scope finding from the #28535 dev (os-dev-report 6555096778, PR #28603 Acceptance notes), measured there. Filed by domain:server seat 2. ⛔ Not a claim. No grade: triage sets the grade.
Reach: a deployment where os package install ./dist/objectstack.json ran before PR #28603, with an artifact whose engines.protocol excludes this runtime (or whose dependencies it does not satisfy).
Reader who acts: domain:server (packages/cloud-connection).
What happens
PR #28603 (#28535) makes the install-local door flatten a body that carries id/version beside a nested manifest (the shape the CLI sends) before it judges engines.protocol, so such an install is now refused 422 OS_PROTOCOL_INCOMPATIBLE. Ledger entries written by an install before that fix are stored in the same lifted shape. At kernel:ready, the rehydrate judges checkProtocolCompat(entry.manifest) on the stored entry unflattened, so the nested range is not read: the dev's probe in cloud-connection's harness re-registered an entry declaring ^17 at boot with no errors and no [protocol] line. The purge/reseed doors that judge entry.manifest read it the same way.
Wanted
The rehydrate (and the purge/reseed doors) judge a stored entry through the same flatten the install door now uses (flattenPackageBody), so a ledgered entry whose nested range excludes this runtime gets the same outcome a flat entry with that range gets at boot today. ⛔ No second flatten and no second handshake. Test: a ledger entry in the CLI's lifted shape declaring an excluded range is treated at boot exactly as the flat one is; a compatible lifted entry rehydrates as today.
Dedupe: searched rehydrate engines.protocol, rehydrate protocol install-local, ledger entry protocol check; #21822 and #26480 (closed) are the flat-shape cases, and no open card covers the lifted shape.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Triage: p3 ·
domain:server·area:api·pm:queue· 2026-11-01T12:13Z⛔ Not a claim.
Ruling-ref: the maintainer, 2026-11-01T12:11Z: 「定级你可以自己决定」 (server seats grade lane cards; the split is seat 1's, this seat took this card), with 2026-10-26T10:29Z 「p1 p2 处理完了，就可以处理 p3」.
origin/main. The finding was measured by the os package install ./dist/objectstack.json: the body leavesenginesnested undermanifest.manifest, so install-local logs "declares no engines.protocol range" and loads an artifact built for^18without the ADR-0087 protocol check #28535 dev in cloud-connection's harness (os-dev-report6555096778).7449e479), in the CLI's lifted shape, whose nested range or dependencies this runtime does not satisfy. New installs are already refused at the door. Nothing is written wrong; such an entry runs where it should have been held back at boot.domain:server(packages/cloud-connection). Wanted stands as written: reuse the install door's flatten, ⛔ no second flatten or handshake.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Claim: PM loop round 4 · card thread · 2026-11-01T12:18Z
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5piHvtwq5wxJ2RJYfjAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-uy0k8q(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: the maintainer, 2026-11-01T03:46Z: 「server 车道现在就是你负责，任务有一大堆啊，都可以派，包括 p3」, with 2026-10-26T10:29Z 「p1 p2 处理完了，就可以处理 p3」. With 2026-11-01T12:11Z 「定级你可以自己决定」; graded p3 by this seat (6557784727).
File surface:
packages/cloud-connection/src/marketplace-install-local-plugin.ts(rehydrate, purge/reseed), its tests; changesetContainer & model:
M,mode:thread,model: opus(--tiernames no path mandate: PM's call, default),effort: mediumClause-②: no expected — the dev measures and declares
Metadata-protocol: none (expected; the dev measures and declares)
Responsibility: the dev reuses the install door's one flatten at the rehydrate and purge/reseed reads, with red-first, controls and ablation; the seat reviews and lands
Thread-read: none
Premise: measured by the #28535 dev (6555096778); the dev re-measures on
origin/mainfirstSerial constraints cleared: PR #28603 merged (
7449e479); the dev re-reads open PRs on the file beforepr_createResume-from: none — fresh from
origin/mainState: →
pm:dispatched, assigned toos-project-manager, recorded by this claim.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_01FEkQ5piHvtwq5wxJ2RJYfj
os-dev-report
{
"issue": 28604,
"status": "done",
"branch": "claude/project-thread-uy0k8q",
"pr": "#28683",
"session": "session_01FEkQ5piHvtwq5wxJ2RJYfj",
"premise_still_valid": true,
"summary": "Re-measured on origin/main 0b6a52e: a ledger entry in the CLI's lifted shape (id/version beside a nested manifest) declaring ^17 was registered and synced at kernel:ready with no error line, and reseed/purge acted on it. The rehydrate handshake, the reseed/purge handshake (refuseProtocolIncompatibleEntry) and the rehydrate's ADR-0141 D5 dependency order now read the entry through the install door's one flattenPackageBody (no second flatten, no second handshake); flattenPackageBody gained a !isPlainObject(body) guard (signature unchanged) so it is total over unshaped ledger values, measured byte-identical on base and head for null/string/number manifests. Outcome parity: a lifted excluded entry gets the flat entry's error line (byte-equal), notLoaded listing marker and 422 from both doors (byte-equal); a compatible lifted entry registers the ledgered body unchanged. At boot a flat entry's dependencies only order the rehydrate (no dependency check runs there), so ordering is the dependency parity. Declared Clause-②: no (narrowing) (claim expected no): an entry that loaded at boot no longer loads and two doors move 200 to 422, the same reading PR 28603 declared for the install door.",
"tests": "head 365d3ac. New cases: protocol-handshake (3), sample-data-not-loaded (3), rehydrate-order (1). Red on base: plugin source swapped to origin/main 0b6a52e (on disk: flatten-at-judge count 0, base judge count 2; restored via git checkout HEAD --, git diff HEAD empty, blob hash = HEAD): 5 failed / 32 passed of 37, exactly the five lifted judge/order cases; both lit controls green on both trees. Green 37/37. Ablation via scripts/ablation-replace.mjs (anchor 1->0 on disk, restored to HEAD blob, git diff HEAD empty each leg; tests import src by relative path, no dist leg): leg 1 rehydrate judge -> 3 red; leg 2 door judge -> 1 red (reseed/purge byte parity); leg 3 dependency order -> 1 red. pnpm --filter @objectstack/cloud-connection test: 65 files / 796 tests passed; typecheck exit 0 (lock VERDICT command-exit 0).",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 60 families on 365d3ac; all 60 exit 0, exit captured before any pipe; --ran: '60 derived famil(ies) accounted for — 60 run, 0 NOT-MEASURED (a DERIVED zero — all 60 recorded an exit code and none of them is 3)'. First runs re-run to exit 0: check-plugin-teardown-shape --self-test exit 3 (shallow clone; fetched 621a487) and check:dual-build-cjs-loads exit 3 (no full dist; ran after a packages/** build). check:type-check-debt exit 0 (lock, 0 raw tsc errors). Record: pm-orders/server/evidence/28604/gates-ran-365d3ac3.txt. CI check-runs on PR 28683: in_progress at report time, not re-run locally.",
"dogfood_battery": "365d3ac3 · os-verify-lock: VERDICT command-exit 0 (held 2009s) · Test Files 369 passed | 3 skipped (372) · Tests 2981 passed | 28 skipped (3009) · no failures",
"mcp_calls": "4 — issue_read x2 (card, card comments), plus ToolSearch schema loads; no MCP write tool",
"api_writes": "2 — fleet-write pr_create (POST pulls, PR 28683, no labels, no assignees; read-back 10082 bytes identical) and this os-dev-report comment (POST issues/28604/comments). Plus git push (not a REST write).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed — a ledger file whose manifest is null throws 'Cannot read properties of null (reading engines)' from checkProtocolCompat at the rehydrate (logged rehydrate failed) and out of the reseed/purge handlers; identical on base and head, no door or producer writes such an entry (PR 28683 Acceptance notes)",
"carrier: none · noted, not filed — seat 2 overlap note: #28565 (server seat 5) adds a call in handleInstall; this PR does not touch handleInstall and keeps flattenPackageBody's signature"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Landing record · #28604 · PR #28683
domain:serverseat 2 ·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-11-01T14:00Za06feb76git merge-base --is-ancestor a06feb76 origin/maingit ls-remote origin refs/heads/gh-readonly-queue/*matching 28683git grep -c "flattenPackageBody(" origin/main -- packages/cloud-connection/src/marketplace-install-local-plugin.ts6558689509).handleInstall.Release: claim
6557844083(session_01FEkQ5piHvtwq5wxJ2RJYfj, branchclaude/project-thread-uy0k8q) · landed.pm:dispatchedremoved; assignee cleared; the card closed on merge.Generated by Claude Code