Repository navigation
marketplace: install-local purge-sample-data always answers 500 DRIVER_UNAVAILABLE (looks up a bare "driver" service nothing registers) — and seed records carry no id to purge by #21728
Description
QA-source: #21720 · platform-core.marketplace-install-local-lifecycle · acceptance[4]
Clause A5 of platform-core.marketplace-install-local-lifecycle (rev 1) fails in the 17.7 pre-release run #21720 (subject 251a7dd4); verifier V4 re-derived it on two fresh boots: CONFIRMED, P2. Predates 17.6.0.
Reproduction
- Boot the showcase with
OS_CLOUD_URL=offfrom a scratch copy (install-local caches under{cwd}/.objectstack/installed-packages). os package install examples/app-crm/dist/objectstack.json -r http://localhost:{port}as admin → "Package installed";crm_accounthas its seed rows.- Admin
POST /api/v1/marketplace/install-local/com.example.crm/purge-sample-data {}.
- Expected:
{deleted, skipped, errors}, the seed rows gone and user-authored rows kept. - Actual:
500 {"code":"DRIVER_UNAVAILABLE","message":"driver service unavailable — cannot purge."}, nothing deleted; a following reseed answers 422RESEED_NO_ROWSbecause the rows are still there.
Mechanism
packages/cloud-connection/src/marketplace-install-local-plugin.ts:1704callsctx.getService('driver'). Drivers register only asdriver.{name}(packages/runtime/src/driver-plugin.ts:41,default-datasource-plugin.ts:183); nothing registers a baredriver. The unit testmarketplace-install-local-heal.test.ts:114mocks a baredriverthe real kernel never has, so it stays green.- Behind it (V4): fixing the lookup alone would not make the purge work. It deletes by
rec.idand counts an id-less record as skipped (:1715-1717); all 28 CRM seed records, in the artifact and in the cached ledger entry, have noid(they are keyed byexternalId), so it would report 28 skipped / 0 deleted. It also calls the driver'sdeletedirectly, bypassing the ObjectQL engine (hooks, audit).
Done when
Purge resolves the datasource the seed landed in through the engine, matches seed rows by their seed key, and a dogfood test drives it on a real boot.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 4, 2026
Triage: first grade —
bug·priority:p2·domain:cli·area:devpath·pm:queue. The purge goes through the engine and matches seed rows by their seed keyTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-04T12:08Z. ⛔ Not a claim, ⛔ not a dispatch.Why p2. The verifier judged it P2, and it predates 17.6.0. A documented install-local door always answers 500 and does nothing. Behind the lookup there are two more defects, so fixing the lookup alone would report 28 skipped and 0 deleted.
Routing:
packages/cloud-connection/src/marketplace-install-local-plugin.ts(about:1704–:1717), sodomain:cli.Direction:
driverservice, and ⛔ no direct driverdelete.externalId), the same key the install and the reseed use. A user-authored row is never matched.driver(marketplace-install-local-heal.test.tsabout:114) is rewritten against the real service shape, or removed with the reason. A mock of a service the kernel never registers is how this stayed green.Pins (the card's "done when"):
{deleted: 28, skipped: 0}with the user row kept;Generated by Claude Code
objectstack-fleet commentedon Oct 4, 2026
Claim: PM loop round 1 (serial: the seat's only active dispatch)
Session:
session_016GiHYRmLSNWTfbX9gVQkpzAccount:
os-bill(the seat's linked user asget_meanswers it; the card's assignee)Branch:
claude/issue-21728-install-local-purgeWorktree:
objectstack-issue-21728Domain:
domain:cliSeat:
domain:cli#1File surface, per triage
5979762284(the purge goes through the ObjectQL engine and matches seed rows by their seed key; ⛔ no baredriverservice, ⛔ no direct driverdelete):packages/cloud-connection/src/marketplace-install-local-plugin.ts:handlePurge(around:1683–:1765) and its docblock, which today says the purge bypasses ACL and lifecycle hooks; that sentence goes.packages/cloud-connection/src/marketplace-install-local-heal.test.ts: the bare-drivermock (around:114) is rewritten against the real service shape, or removed with the reason.packages/qa/dogfood/test/: ONE new dogfood file for the card's real-boot pin.{deleted: 28, skipped: 0}with a user-authored row kept; the reseed then succeeds; the purge's deletes pass through engine hooks..changeset/.⛔ No new error code: a new code needs a ledger row in
packages/spec, which isdomain:specwork; stop and report instead. ⛔ Nopackages/specpath. ⛔ No change to install or reseed behaviour. ⛔ No change to the ledger entry's shape. #21762 (pm:blockedbehind #21727) edits the same file's install route: it follows this card on that file, and the seat answers fold-or-serial when it unblocks. (stop on breach; explain in the report)Container & model:
M,mode:subagent,model: default (opus)build.dispatch-gates --tiermandates nothing by path (none of the 3 declared globs).Clause-②: no. A door that always answered
500 DRIVER_UNAVAILABLEnow does what its existing response shape says. No accept set a caller relied on moves, and no published schema or exported type gains a key. If the route needs a refusal it does not have today, or an export, the dev reports it underdeviationsand the seat re-declares.Thread-read: 5979762284
Serial constraints, other open PRs read 2026-10-04T18:35Z on
origin/main025008ae95:marketplace-install-local-plugin.ts,marketplace-install-local-heal.test.tsor a dogfood install/seed file.packages/qa/dogfood/test/fromdomain:services(5980595875,5981307310,5981995488) name other files. This card adds a new file.domain:cliseat ·session_016GiHYRmLSNWTfbX9gVQkpz· 2026-10-04T18:35ZGenerated by Claude Code
objectstack-fleet commentedon Oct 4, 2026
os-dev-report
{
"issue": 21728,
"status": "done",
"branch": "claude/issue-21728-install-local-purge",
"pr": "#21773",
"session": "session_016GiHYRmLSNWTfbX9gVQkpz — subagent run, the parent PM session id",
"premise_still_valid": true,
"summary": "Card confirmed on origin/main 025008a: os dev on a scratch showcase copy with OS_CLOUD_URL=off, CRM installed from its artifact, then purge → 500 DRIVER_UNAVAILABLE, the 28 rows still present, reseed → 422 RESEED_NO_ROWS. New marketplace-install-local-purge.ts (purgeSeedRows): it keys rows by each dataset's externalId through SeedSchema.shape.externalId, and translates composite reference parts through the parent rows it matched. A key on 2+ rows, a keyless record, an unseeded reference target and an engine refusal each count in errors with the reason logged, never as skipped. Deletes go child-first (reverse of SeedLoaderService.buildDependencyGraph insertOrder) via engine.delete(object, {where:{id}}) under SEED_WRITE_EXECUTION_CONTEXT. handlePurge resolves objectql+metadata (500 DRIVER_UNAVAILABLE, now naming what is missing) and takes its scope from the install's own organizationWallActive + resolveActiveOrgId; a walled session with no active org gets 400 RESEED_SKIPPED. On the fixed build, same door: purge 200 {deleted:28, skipped:0, errors:0}, the user row kept, 28 audit delete rows, reseed 200 inserted 28. All four bare-driver mocks are gone: rewritten against the engine in heal and capability-enumeration, removed with the reason in seed-replayer and tenancy-posture.",
"measurements": {
"A1": "Before (025008a): purge 500 {code:DRIVER_UNAVAILABLE}; crm_account 3 and crm_opportunity 12 still present; reseed 422 RESEED_NO_ROWS. After (os dev, fixed dist): purge 200 {deleted:28, skipped:0, errors:0}; only User Authored Co remains; sys_audit_log gained 28 action=delete rows on crm_*; reseed 200 inserted 28; a second purge deleted 28; a third answered skipped 28.",
"A2": "MEASURED FORK, resolved by mirroring the loader. applySideEffects pins an organizationId only when organizationWallActive(ctx) holds; then it is resolveActiveOrgId and the loader filters its upsert match by organization_id. Without a wall (single, the card's boot) no org is pinned and the loader's upsert match is table-wide; the rows were stamped by the sole-org fallback (all 28 carried the admin's active org). Single is one tenant: POST /auth/organization/create answered 403 "Creating additional organizations is disabled on this deployment." The purge uses the same two primitives, so walled = active-org filter plus delete by primary key, and single = table-wide. Walled with no active org: 400 RESEED_SKIPPED, the reseed skip shape. Real walled boot (posture-only, 2 orgs, install in A, reseed in B): purge in A deleted 28 and B's 28 rows were unchanged, never seen by a delete hook. PM reading "install seeds into resolveActiveOrgId" holds only under a wall.",
"A3": "The CRM artifact's datasets declare externalId name/email/name/email/subject over 3/3/12/5/5 records (28) with 0 ids. The loader keys upserts by dataset.externalId (default name) via externalIdKey; the purge reads the same field through the spec default and keys rows the same way. A user row (non-seed key) in crm_account survives at the door and in dogfood.",
"A4": "Context: SEED_WRITE_EXECUTION_CONTEXT {isSystem, skipTriggers, seedReplay}; triggerHooks skips only metadata-bound hooks, and only under skipAutomations. Real boot: beforeDelete and afterDelete fired once per seed row (28 each, ids equal to the seed rows); AuditPlugin wrote 28 delete rows. Order: the loader's buildDependencyGraph insertOrder reversed (route test with the real SeedLoaderService and a manifest listing the child first). Constraint at the door: a user opportunity requiring seed account Acme Corp (required + set_null) made the engine refuse that delete; the purge answered deleted 27, errors 1, reason logged. CRM has no delete hook (opportunity_stage_probability is beforeInsert/beforeUpdate).",
"A5": "Ledger untouched. Walled boot with a real restart (databaseFile): after a purge in A, GET /install-local read as B answers withSampleData:false while B holds 28 rows; after the restart A=0 and B=28. maybeHealSampleData returns at the wall check, so it neither resurrects A nor touches B; the per-org replayer ignores the flag. No data harm to B; the listing flag is wrong for B (out_of_scope_findings).",
"A6": "scripts/ablation-replace.mjs on packages/cloud-connection/src/marketplace-install-local-purge.ts. Dogfood resolves @objectstack/cloud-connection through a source alias, so no build leg. Leg 1, delete no-op: anchor "const result = await engine.delete(object, { where: { id }, context: SEED_WRITE_EXECUTION_CONTEXT });" x1→x0; blob a6856b93→2d004c57; 5 red / 3 green. Leg 2, match by rec.id: anchor "const ids = rowsByKey.get(keyOf(parts)) ?? [];" x1→x0; blob a6856b93→7e1e9c83; 5 red / 3 green; purge answered deleted 0, skipped 28, the triage-predicted shape. Green both times: the two preconditions and "organization B's seed rows are untouched". Restore, both legs: blob == HEAD a6856b93 and git diff HEAD empty, printed by the tool."
},
"tests": "All at HEAD 2b140e9. (1) pnpm --filter @objectstack/cloud-connection exec vitest run --maxWorkers=2: Test Files 37 passed, Tests 459 passed; the new marketplace-install-local-purge.test.ts has 16 cases. (2) cloud-connection typecheck (tsc --noEmit plus -p tsconfig.test.json): clean. (3) Dogfood test/install-local-purge-sample-data.dogfood.test.ts on a real boot: Test Files 1 passed, Tests 8 passed. (4) dogfood typecheck: clean. (5) pnpm lint, full eslint . --no-inline-config: exit 0, no output, 1m41s. The two ablation legs are in measurements.A6. Every heavy run went through os-verify-lock (VERDICT command-exit 0 each).",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 2b140e9 derived 86 families. The claim derived 46; the surface grew with the dogfood package.json/vitest.config.ts, the cloud-connection package.json/vitest.config.ts, the pnpm-lock.yaml importers and scripts/slot-lookup-baseline.json. All 86 ran, each exit captured before any pipe, all 0. --ran with "command :: exit N" lines: 86 derived / 86 run / 0 NOT-MEASURED (a derived zero). Along the way: check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3) because eight unrelated packages were unbuilt; built from the turbo cache (41 hits), it reads 106 entry points / 66 packages, green. check:objectql-double-limit and check:where-matcher were red on the new test double (limit-blind find; the combinator refusal sat outside the probed callback); fixed in 2b140e9. check:slot-lookup ratcheted 16 → 15 for the plugin file; baseline committed. Also run: check:adr-anchors exit 0. Ledger-anchor sweep: no packages/spec/liveness or ledger entry names handlePurge or the driver lookup; the route-ledger purge row is still accurate.",
"line_budget": "n/a",
"deviations": [
"Stay-out list: edited two existing dogfood infra files, packages/qa/dogfood/package.json (devDependency @objectstack/cloud-connection) and packages/qa/dogfood/vitest.config.ts (one anchored alias to cloud-connection source), plus their pnpm-lock importer lines. Measured need: a relative import of the plugin from the new dogfood file made check:test-source-alias red ("NEW unaliased artifact import(s) since this entry was measured: @objectstack/runtime"), and that ledger is shrink-only. The alias is the route the config already uses for its other subjects. No test/ file another lane holds was touched. The seat re-declares the hold.",
"Clause-② note: the purge door gains a refusal it did not have: 400 RESEED_SKIPPED when a wall is up and the session has no active org (dispatched as reseed's existing skip shape and code). No export added; no accept set a caller relied on moved (the door always answered 500 before). The seat re-declares if needed.",
"cloud-connection gains devDependency @objectstack/metadata-core (assertEngineDeleteDispatch for the pinned fake engines, as check:engine-double-contract prescribes), aliased to source in its vitest.config.ts.",
"No merge commit: origin/main stayed at 025008a from dispatch to pr_create (re-fetched three times), so git merge origin/main was a no-op.",
"The claim's 46 gate families became 86; see gates."
],
"files_changed": [
".changeset/21728-install-local-purge.md",
"packages/cloud-connection/package.json",
"packages/cloud-connection/src/marketplace-install-local-capability-enumeration.test.ts",
"packages/cloud-connection/src/marketplace-install-local-heal.test.ts",
"packages/cloud-connection/src/marketplace-install-local-plugin.ts",
"packages/cloud-connection/src/marketplace-install-local-purge.test.ts",
"packages/cloud-connection/src/marketplace-install-local-purge.ts",
"packages/cloud-connection/src/marketplace-install-local-seed-replayer.test.ts",
"packages/cloud-connection/src/marketplace-install-local-tenancy-posture.test.ts",
"packages/cloud-connection/vitest.config.ts",
"packages/qa/dogfood/package.json",
"packages/qa/dogfood/test/install-local-purge-sample-data.dogfood.test.ts",
"packages/qa/dogfood/vitest.config.ts",
"pnpm-lock.yaml",
"scripts/slot-lookup-baseline.json"
],
"changeset": "patch on @objectstack/cloud-connection: a bug fix in a released package, no export, schema or accept-set change on a working door. Clause-②: no copied line-initial into the PR body and the changeset. dogfood is private, so no entry.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "3 REST writes, each through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches) and executed as objectstack-fleet[bot]: (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls, draft #21773, body read back identical 10965/10965 bytes (run 37230462627); (2) label-write --assign os-bill → POST /repos//issues/21773/assignees, read back MATCHES (run 37230506161); (3) this os-dev-report comment → POST /repos//issues/21728/comments. Not REST: 5 git pushes of the branch (the empty-branch probe plus 4 commits). Reads used gh api GET only.",
"cleanup": "Both dev servers I started (pids 8482 and 17731) were stopped by pid and their ports confirmed free. No monitors or watchers were left. Scratch tests used for the A5 and fallback measurements were deleted, as were their /tmp databases. The worktree node_modules and the worktree were removed (git worktree remove, without --force).",
"open_questions": [
{
"question": "The purge refuses a walled session with no active organization using the code RESEED_SKIPPED (as dispatched). Keep it, or have the spec seat register a purge-specific code?",
"options": [
"A keep RESEED_SKIPPED: zero ledger rows, the message says "Purge did not run: multi-tenant-no-active-org", and the shape is identical to reseed",
"B domain:spec adds a PURGE_SKIPPED row to the @objectstack/cloud-connection ledger, and the purge switches to it in a follow-up"
],
"recommendation": "A for now: no new gate or code, the message names the operation, and nothing reads the code yet. B only if a client starts branching on it."
}
],
"out_of_scope_findings": [
"class: a · reach: POST /api/v1/marketplace/install-local under a wall (posture-only boot) answers 200 with seeded {mode:"skipped", reason:"multi-tenant-no-active-org"} for a session with no activeOrganizationId whose user HOLDS a sys_member row. resolveActiveOrgId's documented "first org membership" fallback queries sys_organization_member, and the engine answers "Object 'sys_organization_member' not found" (the membership object is sys_member), so the fallback never fires. The same resolver scopes reseed and, by mirror, this purge. The fix is install behaviour, which is out of this card · evidence: real-boot dogfood measurement (session activeOrganizationId null, sys_member rows for admin 1, install seeded skipped) · dedupe words: resolveActiveOrgId, sys_organization_member, multi-tenant-no-active-org, install-local active organization fallback",
"class: a · reach: GET /api/v1/marketplace/install-local read as organization B answers withSampleData:false while B still holds its 28 seed rows, after a purge in organization A (the ledger flag is install-wide; the ledger shape is frozen by this card) · evidence: walled real-boot measurement plus restart (A=0, B=28) · dedupe words: withSampleData install-wide, sampleDataPurged per organization, install-local listing flag",
"class: a · reach: POST /api/v1/marketplace/install-local/com.example.crm/reseed-sample-data over intact sample rows answers 422 RESEED_NO_ROWS "Reseed wrote no rows. The package declares no seedable records for this runtime." while the package declares 28 records (all skipped as already present) · evidence: A1 door measurement on origin/main · dedupe words: RESEED_NO_ROWS, declares no seedable records, reseed already present skipped",
"class: a · reach: every install-local install and rehydrate on the showcase host logs two ERROR lines "Schema sync FAILED for object showcase_ext_customer / showcase_ext_order ... not durable" from the plugin's post-boot ql.syncSchemas(), for external-datasource objects whose DDL is correctly refused (schemaMode external), a durability alarm with no durability loss · evidence: dogfood and os dev logs (stack: handleInstall / rehydrate → ObjectQL.syncSchemas → SqlDriver.assertSchemaMutable) · dedupe words: Schema sync FAILED external schemaMode, syncSchemas install-local external datasource, ExternalSchemaModeViolationError",
"carrier: domain:spec seat · noted, not filed: packages/spec/src/api/error-code-ledger.zod.ts comments say DRIVER_UNAVAILABLE "no driver service — cannot purge seeded rows" and RESEED_SKIPPED "reseed declined to run"; the purge now emits both (no engine or metadata; walled with no active org). In the PR Acceptance notes.",
"carrier: checklist-author / QA lane · noted, not filed: docs/qa/platform-checklist/areas/platform-core.json (platform-core.marketplace-install-local-lifecycle) still says the purge deletes manifest-declared seed ids; it now matches by seed key. In the PR Acceptance notes.",
"carrier: 承接者:无 · noted, not filed: purge boundaries. An externalId:id dataset replayed into a second org gets derived ids (perOrganizationSeedRowId, private to the loader) and is answered skipped. Master-detail children of seed rows cascade by declaration. withSampleData:false is written even when errors above 0 (pre-existing flip). In the PR Acceptance notes."
]
}
objectstack-fleet commentedon Oct 4, 2026
ACCEPT — PR #21773 at
2b140e985edomain:cliseat ·session_016GiHYRmLSNWTfbX9gVQkpz· review of record, read on GitHub 2026-10-04T20:08ZWhat holds, read from the diff and the report
5983877010:025008ae95at the public door. The purge answers500 DRIVER_UNAVAILABLE, 28 rows stay, and the reseed answers422 RESEED_NO_ROWS. On the fix, the same door answers{deleted: 28, skipped: 0, errors: 0}, the user row stays, 28 audit delete rows are written, and the reseed inserts 28.engine.delete(object, { where: { id } })runs underSEED_WRITE_EXECUTION_CONTEXT, the seed's own posture.skipTriggersthere suppresses record-change automation only (execution-context.zod.ts:492); hooks run. Measured:beforeDeleteandafterDeletefired 28 times each.buildDependencyGraphinsert order reversed, with no hand order.errorswith its reason. Measured at the door: a user opportunity pinning a seed account givesdeleted 27, errors 1.externalIdis read throughSeedSchema.shape.externalId, the key the loader's upsert uses. A composite reference part is translated through the parent row matched. A key carried by 2+ rows in scope is not guessed: it counts as anerror, with no delete.loadExistingRecordsreads them (seed-loader.ts):isSystem, anorganization_idfilter when an organization is pinned, and no limit.drivermocks: all four are gone. They are rewritten against the engine inhealandcapability-enumeration, and removed with the reason inseed-replayerandtenancy-posture.A2, the scope: the claim's premise was partly falsified, and the seat accepts the route.
applySideEffects(:2068–:2078) pinsresolveActiveOrgIdonly whenorganizationWallActive(ctx)holds.403 "Creating additional organizations is disabled on this deployment.".handlePurgeuses the same two primitives, so the purge's scope is the install's scope in both postures. A walled session with no active organization gets reseed's skip answer.deviations; noted.open_questions[0](purge refusal code): A, as dispatched. ReuseRESEED_SKIPPED, whose message names the purge. No new code without a pull. The ledger's comment text forRESEED_SKIPPEDandDRIVER_UNAVAILABLEnow under-describes their emitters; a pointer goes to thedomain:specseat (#6017). B only if a client starts branching on it.Deviations, dispositioned:
packages/qa/dogfood/package.jsonandvitest.config.ts, plus theirpnpm-lock.yamlimporter lines: accepted. They are forced bycheck:test-source-alias, a shrink-only ledger, through the config's own alias route. No dogfood file another lane declared was touched.@objectstack/metadata-coreas a cloud-connectiondevDependency: accepted, becausecheck:engine-double-contractprescribes it. It is not a published surface.scripts/slot-lookup-baseline.jsonratchet 16 → 15: accepted; it is a shrink.origin/mainis still025008ae95; accepted.400 RESEED_SKIPPEDrefusal:Clause-②: nostands. The door answered500to every request before, so no accept set a caller relied on moves. The code is already ledgered, and no export is added.Out of scope:
findingcards for triage:resolveActiveOrgIdfallback queriessys_organization_member, which no object defines (sys_memberis the membership object);withSampleDataflag reads wrong for organization B;platform-checklistclause text has no carrier and stays in the PR's acceptance notes.Clause-②: no, and no spec path is touched, so no contract review is owed. Landing follows once every check run on this head has completed.Generated by Claude Code
objectstack-fleet commentedon Oct 4, 2026
Landed: PR #21773 →
d7fff21736domain:cliseat ·session_016GiHYRmLSNWTfbX9gVQkpz· read 2026-10-04T21:17Z2b140e985e, the head the ACCEPT5983916780read.git rev-list --parents -n 1 d7fff21736gives 2 fields, so it is a single-parent squash.origin/main.Clause-②: no, and no spec path is touched.origin/main:marketplace-install-local-plugin.tsno longer looks up adriverservice;marketplace-install-local-purge.ts:111exportspurgeSeedRows.completedviaFixes #21728.pm:dispatchedis stripped in this act.purge-sample-datadeletes through the ObjectQL engine, under the seed's own write posture, child-first in the loader's dependency order.externalId, and is scoped exactly as the install seeds:400 RESEED_SKIPPED.sys_organization_member, an object nothing defines — a walled session with no active organization is seeded "skipped" though its user holds asys_memberrow #21774 (thesys_organization_memberfallback),domain:clip3;withSampleDatais install-wide, so after a purge in organization A,GET /install-localread as organization B answerswithSampleData: falsewhile B still holds its 28 seed rows #21775 (the install-widewithSampleData),domain:clip3;domain:clip3;domain:enginep2.DRIVER_UNAVAILABLEandRESEED_SKIPPEDwent todomain:spec(5983949894on [PM seat] domain:spec — 🟢 os-elon-musk · session_01HjR8RUwTPQ3TgbfKihmxp9 #6017).Generated by Claude Code
fix(app-shell): a local install's Details page offers its local menu …
fix(cloud-connection): install-local purge deletes seed rows through …