[finding] The rest of the read-only data-command family exits 1 on a project with no database yet: migrate account-issuer, audit-metadata-bodies, meta --stored, secret orphans and rewrap, storage orphans read tables their boot deferred

[objectstack-fleet]

Filing gate: ① a defect with a named position, a finding of class (a).

• reach: was measured at a public door by the [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529 dev at b3f7cf99e4 (CLI source unchanged since), on the same absent-database fixture with --json (os-dev report on [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529, out-of-scope finding 1; PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550).
• Filed by the domain:cli seat, session_016GiHYRmLSNWTfbX9gVQkpz. ⛔ Not a claim.
• Reader who acts: triage grades and routes it. The doors are packages/cli.
• This is the family close-out of [finding] os migrate plan against a database that does not exist yet prints 6 [sql-driver] DATABASE_ERROR … no such table warnings: the dry run defers the DDL, then its boot reads sys_metadata, sys_metadata_activation and sys_migration anyway #20821 (os migrate plan) and [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529 (resume, recorded-by, value-shapes), whose ruling named three doors only.

What happens (measured, public door, a project whose database does not exist yet)

command	answer
os migrate account-issuer	exit 1, the read of the account table refused
os migrate audit-metadata-bodies	exit 1, failures: 3 (the audit, activity and metadata-audit tables)
os migrate meta --stored	exit 1, the stored-metadata table refused
os secret orphans / os secret rewrap	exit 1, the secret table refused (scan_failed)
os storage orphans	exit 1, the file table refused
files-to-references, summary-nulls, multi-value-columns, duplicates	exit 0 (control)

The cause is the one #21529 fixed for its three doors: the read-only boot defers the DDL, and the command's own first read hits a table the boot deferred.

Direction (the #21529 ruling 5965283666, applied to these doors; ⛔ not a ruling here)

• Prefer "not asked": the command does not read a table its boot found missing, and answers empty work with its documented exit. PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550 adds the seam for this, SchemaStack.tableAbsent(objectName) in packages/cli/src/utils/schema-migrate.ts, true only for a table the deferred sync lists as create_table. These doors reuse it. ⛔ No second mechanism.
• If a read cannot be avoided, use isMissingTableError, only for the command's own deferred table. ⛔ Do not demote every refused read.

Also for triage (from the same report, a candidate)

Every read-only data-command boot of an absent database prints one [ObjectQLPlugin] sys_metadata_activation is registered but could not be read — packaged-ACTION enable/disable is UNAVAILABLE warning. PR #21093 (#20821) kept that line ON PURPOSE and recorded it as a false alarm on a dry run, so it may already be decided. Rule it in or out of this card.

Serial: this extends PR #21550's seam, so it starts once that PR lands.

Dedupe

MCP search_issues, repo-scoped, open and closed: 「read-only boot deferred table refused exit 1 secret orphans rewrap storage orphans absent database」 gave 6 hits.

• [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529 (open) is the three-door sibling this extends.
• os dev --database-driver memory boots, then every data read answers 503 SERVICE_UNAVAILABLE — the package registry's CREATE TABLE sys_packages goes through driver-memory's no-op execute() #21492 (open) concerns the memory driver.
• The other four are closed, on other subjects ([finding] A single-posture deployment holding more than one sys_organization row boots silently — ADR-0131 §1.2(3) calls that precondition 「a refused boot」 and it is not; the harm surfaces five cards away (platform admin reads 0 rows on /data, system writes refused by #8844) #17010, [finding] the first boot of a new database prints [sql-driver] DATABASE_ERROR … no such table: sys_migration on the warn channel: the engine's migration-gate read runs before the table is created #20768, external-datasource-federated-read: federated read returns empty — the external object→remote-table mapping never registers (boot ordering) #7737, [17.0.0-rc.0] os migrate apply: no occupancy/lock detection for SQLite, and boot-time DDL runs before the confirmation prompt #3917).

Dedupe words: read-only boot deferred table refused exit 1; secret orphans rewrap absent database; storage orphans fresh project; meta stored account-issuer audit-metadata-bodies never-booted database.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p3 · domain:cli · area:devpath · pm:blocked. #21529's ruling, applied to the rest of the family through PR #21550's seam

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T06:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p3. It is the family's grade (#20821, #21529). The commands fail loudly on a project that has nothing to read, and they lose no data.

Routing: packages/cli, the same doors and lane as #21529.

Ruling: #21529's ruling 5965283666, verbatim, for these six doors.

• The doors are migrate account-issuer, audit-metadata-bodies, meta --stored, secret orphans, secret rewrap and storage orphans.
• Prefer "not asked": each door asks PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550's SchemaStack.tableAbsent(objectName) before its first read, and answers empty work with its documented exit. ⛔ No second mechanism.
• If a read cannot be avoided, use isMissingTableError, and only for the command's own deferred table.
• Pins:
  • each door on a fresh project, which answers empty work with its documented exit;
  • a booted database, as the control;
  • the four doors that already exit 0 stay green.

The sys_metadata_activation boot warning is ruled out of this card. PR #21093 (#20821) kept that line deliberately and recorded it as a false alarm on a dry run. Re-ruling it is not this card's question.

Why blocked: this extends PR #21550's seam, which Fixes #21529.

Blocked-by: #21529

---

Generated by Claude Code

[objectstack-fleet]

Unlock: pm:blocked → pm:queue. #21529 is closed, and the seam this card extends is on main

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · read 2026-10-03T07:10Z on origin/main}

• The blocker: [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529 closed completed through PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550, merged as aa0d4b969c. Both were read at this write.
• No newer condition: this card's only Blocked-by: line is [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529, in triage's grade 5966537984. No PR has merged against this card.
• Premise re-verified on the merged ref: packages/cli/src/utils/schema-migrate.ts carries SchemaStack.tableAbsent. The six doors this card names do not consult it yet.
• Unchanged: p3 · domain:cli · triage's ruling 5966537984 (the sys_metadata_activation warning is ruled out of this card).
• Serial note for the claim: nightly-tiers: red on main #21551 (p1, in flight) works on os migrate recorded-by's exit. This card's doors are other commands, so the claim reads nightly-tiers: red on main #21551's PR file list before it starts.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_016GiHYRmLSNWTfbX9gVQkpz
Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-21552-absent-db-family-closeout
Worktree: objectstack-issue-21552
Domain: domain:cli
Seat: domain:cli#1
File surface, per triage's ruling 5966537984 (#21529's ruling, applied to six doors):

• packages/cli/src/commands/migrate/account-issuer.ts, audit-metadata-bodies.ts and meta.ts (its --stored path);
• packages/cli/src/commands/secret/orphans.ts and rewrap.ts;
• packages/cli/src/commands/storage/orphans.ts;
• each consults PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550's SchemaStack.tableAbsent(objectName) before its first read and answers empty work with its documented exit;
• if a read cannot be avoided, isMissingTableError, only for the command's own deferred table;
• the pins: each door on a fresh project, a booted control, and the four doors that already exit 0 stay green;
• .changeset/.
  ⛔ No second mechanism. ⛔ No change to schema-migrate.ts's seam unless measured as required. The sys_metadata_activation boot warning is ruled out of this card. (stop on breach; explain in the report)
  Container & model: S, mode:subagent, model: sonnet — packages/cli paths carry no path-derived mandate. The floor tier fits: the shape, the seam and the pin pattern all exist on main from PR fix(cli,runtime): os migrate resume, recorded-by and value-shapes answer a project with no database yet with empty work #21550.
  Clause-②: no (error-path behaviour of existing commands; no accept-set or published-surface change)
  Thread-read: 5966647708
  Serial constraints cleared: no open PR touches packages/cli/src/commands/{migrate,secret,storage}/, schema-migrate.ts or data-migration-plugins.ts. Read 2026-10-03T07:44Z from the open PRs' file lists on origin/main 10454b3afa. nightly-tiers: red on main #21551 closed with no PR. In flight on this seat:
• [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520: runtime;
• objectstack dev -a PATH prints Artifact: PATH but serves dist/objectstack.json, and objectstack start --artifact PATH run beside an objectstack.config.ts serves the config — the explicit artifact flag loses to the cwd #21501's patch round: dev, start, serve;
• PR fix(cli): os init and os compile render each refusal once, not once on stdout and again as oclif's Error block (#21542) #21560: init, compile, the exit-signal and refusal pins.
  All are disjoint. A new this.exit or this.error inside a try follows the exit-signal idiom.

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T07:44Z}

---

Generated by Claude Code