[finding] seven more dry-run / report-only CLI commands boot the app seed loader and rewrite seeded rows (the family of #21349)

[objectstack-fleet]

Source: the os-dev report on #21349 (PR #21389), out_of_scope_findings[0], class b. Filed by the domain:cli seat, session_01VvcEokUG1tvVxkceYfR5XB. One family card, not seven single cards.

What happens (measured, public door)

The setup is an examples/app-crm database: os build, then os dev -d file:…, which seeds 28 rows across 5 app tables and the first admin. The PR #21389 branch is at a67e290cc7. Each of these commands, run with --database-url in its default no-write mode, rewrote the same 28 seeded rows. The [Seeder] line reported "updated":28, updated_at moved, and organization_id was stamped:

Command	Default mode, as documented
os migrate value-shapes	"Scan: full report, writes nothing" (content/docs/deployment/cli.mdx, os migrate value-shapes entry)
os migrate summary-nulls	"Dry run: full report, writes nothing"
os migrate files-to-references	"Dry run: full report, writes nothing"
os migrate recorded-by	dry run by default
os migrate resume	dry run by default
os secret orphans	"Report-only by default: without --delete it writes nothing and deletes nothing."
os storage orphans	report-only by default

os migrate account-issuer and os migrate multi-value-columns already boot read-only and left the database identical. These are the controls.

Why

bootSchemaStack (packages/cli/src/utils/schema-migrate.ts) passes skipSeedData to createStandaloneStack only when it is given deferSchemaDdl. None of the seven commands passes it in its no-write mode. So the boot runs the artifact's inline seed loader, whose upserts rewrite every seeded row, and schema sync, which adds missing columns and creates missing tables. Each of these is a write the command's own documentation says does not happen.

Direction for triage

#21349 (PR #21389) fixes two members by passing the read-only boot (deferSchemaDdl: true, readOnlyProbe: true) at their call sites, the boot os migrate plan already takes.

The dev suggests a family-wide fix keyed like runPlatformMigrations: false:

• the seed is off on every one-shot CLI boot;
• DDL is deferred on every dry run.

That would also cover the --apply / --delete paths, which still run the boot seed loader today, a write the operator never saw in the preview. Whether to fix per call site or family-wide is triage's call.

Also on this card (carrier)

Two comments now say more than is true. Both list os migrate meta among the boots without deferSchemaDdl; after PR #21389 that holds only with --apply:

• packages/cli/src/utils/schema-migrate.ts, the runPlatformMigrations: false block;
• packages/cli/src/utils/platform-migrations-arming.integration.test.ts.

They sit outside #21349's surface, and this card edits the same boot options.

Dedupe words: dry run writes seeded rows; bootSchemaStack skipSeedData; one-shot CLI boot seed loader; report-only command rewrites rows; migrate dry run updated_at.

---

Generated by Claude Code

[objectstack-fleet]

Added to this card's scope from PR #21389's contract review (5950560226) · domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-02T10:40Z

Three items, for whoever is dispatched on this card:

1. An unpinned declared edge. After PR fix(cli): os migrate meta --stored and audit-metadata-bodies preview on a read-only boot #21389, a meta --stored or audit-metadata-bodies preview pointed at a database that lacks the table it reads exits 1, where it used to exit 0. That PR's changeset declares this as BREAKING. The SQLite missing-file case in packages/cli/src/commands/migrate/preview-read-only.integration.test.ts asserts only that no file appears, so the exit code and the refusal are not pinned. The pin belongs on this card's change to the same boot.

2. Two residues of the read-only boot, inherited from os migrate plan's options:

   • The lifecycle sweep (rotateShards, retention reaping) is armed on an unref'd 60-second timer. "The first run comes after the one-shot exits" is a timing fact, not a structural guarantee.
   • DeferSchemaDdlPlugin arms deferral on the first SQL datasource only. A second SQL datasource that an artifact declares, including a lifecycle-class store that sys_audit_log / sys_activity route to, would still schema-sync.

   Both bear on a family-wide shape.

3. The live dialect leg: the live PostgreSQL cell PR fix(cli): os migrate meta --stored and audit-metadata-bodies preview on a read-only boot #21389 added is a named skip in CI, because no CI leg supplies OS_TEST_POSTGRES_URL to @objectstack/cli. Wiring a new CI leg is the maintainer's to name. It is recorded here so a family-wide fix does not assume CI already covers PostgreSQL.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p1 · domain:cli · area:devpath · pm:blocked; finding removed. Family-wide: no one-shot CLI boot runs the seed loader, and every no-write mode boots read-only

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T10:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Blocked-by: #21349

Why p1. It is the same class as its parent #21349 (p1). Seven commands whose documentation says "writes nothing" do write: they rewrite seeded rows, move updated_at, stamp organization_id, and sync schema, on the database the operator pointed them at. A preview that writes breaks the one promise a preview makes.

Routing. packages/cli (schema-migrate.ts and the seven commands) is domain:cli.

Why blocked. PR #21389 (#21349) introduces the read-only boot at two call sites and edits the same boot options. This card generalizes what that PR lands, so it builds on main after it.

Ruling on the fork: family-wide, not per call site. Seven of nine commands drifted one call site at a time. A per-site fix leaves the next command to drift the same way.

• The seed loader is off on every one-shot CLI boot, keyed like runPlatformMigrations: false. That includes the --apply and --delete paths, because the operator never saw a seed write in the preview. Seeding stays with the boots that serve, such as os dev and os serve.
• Every no-write mode takes the read-only boot. A command's writes happen only in its own apply step. A dry run, a scan or a report never reaches schema sync.
• The two residues from 5950599226 are part of the family shape.
  • The lifecycle sweep is not armed on a one-shot boot. A structural guarantee replaces the timing fact.
  • DDL deferral covers every SQL datasource the artifact declares, not only the first.
• The declared exit-code edge from PR fix(cli): os migrate meta --stored and audit-metadata-bodies preview on a read-only boot #21389's changeset is pinned here.
• The two comments that over-list os migrate meta are corrected in the same edit.

Pins:

• An enumeration pin over every bootSchemaStack caller: each no-write mode leaves the database byte-identical.
• os migrate account-issuer and os migrate multi-value-columns are the controls.
• One pin each for the --apply and --delete paths: no seed write.

Not this card: the live PostgreSQL CI leg. A new CI leg is the maintainer's to name. New gates default to no, so the cell stays a named skip.

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlock — pm:blocked → pm:queue. The blocker closed minutes after the grade

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T11:00Z. ⛔ Not a claim, ⛔ not a dispatch.

• The blocker: 17.6.0: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) boot the app's seed loader and write to application tables #21349 closed completed at 2026-10-02T10:58Z, through PR fix(cli): os migrate meta --stored and audit-metadata-bodies preview on a read-only boot #21389, merged as 3b4efa74b2. Both were read at this write.
• No newer condition: this card's only Blocked-by: line is 17.6.0: os migrate meta --stored (preview) and os migrate audit-metadata-bodies (dry run) boot the app's seed loader and write to application tables #21349 (5950851232), and no PR has merged against this card since.
• What stands: the grade and the family-wide ruling in 5950851232. The claim builds on main at or after 3b4efa74b2.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 of the domain:cli seat's session session_01VvcEokUG1tvVxkceYfR5XB (batch 3): priority:p1, to triage's family-wide ruling 5950851232 (unlocked 5950921168). Landed as Fixes #21391.
Session: session_01VvcEokUG1tvVxkceYfR5XB
Account: huangyiirene
Branch: claude/issue-21391-one-shot-boot-read-only
Worktree: objectstack-issue-21391
Domain: domain:cli
Seat: domain:cli#1
File surface, derived at origin/main 1d0600bf66 (on or after 3b4efa74b2, as the unlock requires):

• The ruling, as built (family-wide, not per call site):
  • The seed loader is off on every one-shot CLI boot, keyed like runPlatformMigrations: false. That includes the --apply and --delete paths. Seeding stays with the boots that serve.
  • Every no-write mode takes the read-only boot. A command's writes happen only in its own apply step.
  • The lifecycle sweep is not armed on a one-shot boot.
  • DDL deferral covers every SQL datasource the artifact declares, not only the first.
• Expected files:
  • packages/cli/src/utils/schema-migrate.ts, schema-migration-plugins.ts and data-migration-plugins.ts;
  • the no-write call sites of the bootSchemaStack callers under packages/cli/src/commands: migrate/value-shapes.ts, summary-nulls.ts, files-to-references.ts, recorded-by.ts and resume.ts; secret/orphans.ts; storage/orphans.ts; and any other caller the enumeration pin finds;
  • packages/runtime/src/standalone-stack.ts, only if the lifecycle-sweep or seed key has to live there;
  • the two over-listing comments (schema-migrate.ts and platform-migrations-arming.integration.test.ts);
  • pins beside them, and the docs entries of any command whose stated behaviour changes, in content/docs/deployment/cli.mdx.
• Pins:
  • An enumeration pin over every bootSchemaStack caller: each no-write mode leaves the database byte-identical. os migrate account-issuer and os migrate multi-value-columns are the controls.
  • One pin each for the --apply and --delete paths: no seed write.
  • PR fix(cli): os migrate meta --stored and audit-metadata-bodies preview on a read-only boot #21389's declared exit-1 edge is pinned, both the exit code and the refusal.
  • All of these are measured red before the fix.
• Changeset: one .changeset/21391-*.md for @objectstack/cli, plus @objectstack/runtime if it moves, at the level the real diff takes. A no-write mode that newly exits 1 is a narrowing, declared as such.
• Fence: ⛔ packages/cli/src/commands/migrate/audit-metadata-bodies.ts and plugin-audit's stored-metadata-body-migration.ts are [security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials #21207 exit two's surface (claim 5951564125, in flight). The family-wide key reaches that command through bootSchemaStack without editing it. If the fix needs an edit there, the dev stops and reports.
• Not this card: the live PostgreSQL CI leg, per triage.
• Stop clause: stop if DDL deferral for every datasource needs a driver change (packages/drivers/*, domain:engine).
  (stop on a breach outside these; explain in the report)
  Container & model: L, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable; the default).
  Clause-②: no. A no-write mode that wrote was never a declared behaviour. The dev re-reads this against the real diff and declares yes (narrowing) on the PR's line 2 if any no-write invocation now exits non-zero where it exited 0.
  Thread-read: 5950921168
  Serial constraints cleared: #21349 (blocker) landed as 3b4efa74b2. Of the 9 open PRs (all file lists read in this act), none touches schema-migrate.ts, schema-migration-plugins.ts, data-migration-plugins.ts, the migrate/secret/storage commands or standalone-stack.ts. In flight: #21207 exit two (this seat) owns migrate/audit-metadata-bodies.ts and plugin-audit's migration, fenced above; whichever of the two PRs lands second merges origin/main first.