Repository navigation
[finding] every artifact boot on a fresh :memory: database logs Insert operation failed … UNIQUE constraint failed: sys_migration.id with a full knex stack in Boot diagnostics #22099
Description
Activity
Path: the road — start: a fresh boot's diagnostics show only real faults | 缺项 | P3
Triage: first grade,
bug·priority:p3·domain:cli·area:devpath·pm:queue(findingremoved). Measure first, then make the boot'ssys_migrationjournal write idempotent and silent on re-entryTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-07T16:14Z. ⛔ Not a claim, ⛔ not a dispatch.Triage: lands where the boot writes the
sys_migrationjournal. Every writer of that object is underpackages/cli(git grep -l sys_migration -- packageslistscommands/serve.ts,utils/schema-migration-plugins.ts,utils/data-migration-plugins.tsand themigratecommands) ⇒domain:cli; rationale: the boot sequence issues the second insert. The engine'screateWithAutonumberResynconly reports it.- Why p3: every fresh
:memory:artifact boot prints a failed platform insert with a full stack in Boot diagnostics (6 of 6 boots, measured by cli: app branding assets are served only from<cwd>/assets(orOS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071's dev). It buries real warnings, the same class as boot output: the "schedule trigger is NOT bound" sentence (~600 chars) prints twice for every scheduled flow — 16 of an 8-flow app's boot lines — and the loopback OAuth-over-HTTP warning fires on every localhost boot; one summary line per warning class #22073. No lost write is shown. - Measure first:
- which boot step issues the second insert of the same migration id;
- whether any write is lost, or only duplicated and refused;
- whether a file-backed SQLite or PostgreSQL first boot shows it.
- Direction: the second insert is not issued, or the journal write is idempotent and says nothing on re-entry. ⛔ No catch-all that silences other insert failures.
Clause-②: no. Patch changeset.
- Why p3: every fresh
Claim: PM loop round 5
Session:session_01RWZbGvPFcRKvUqASZtunCU
Account:os-warren(the seat's linked user asget_meanswers it; the card's assignee)
Branch:claude/issue-22099-sys-migration-boot-double-insert
Worktree:objectstack-issue-22099
Domain:domain:cli
Seat:domain:cli#1
File surface, per triage6041957961(measure first), read onorigin/mainbafb58bb:- The boot step that issues the second
sys_migrationinsert of the same id. Triage's census of the writers is all underpackages/cli:commands/serve.ts(the served kernel's migration infrastructure, about:3915–:3950),utils/schema-migration-plugins.tsandutils/data-migration-plugins.ts. The dev names the one it is before editing, and the fix lands there: the second insert is not issued, or that journal write is idempotent and says nothing on re-entry. - Pins in
packages/cli: a fresh:memory:artifact boot logs noInsert operation failed … sys_migrationrecord. A real insert failure on another object still logs (control). A second boot on the same file-backed database does not rewrite the journal row (control). .changeset/*.md:@objectstack/clipatch.- ⛔ No catch-all that silences other insert failures. ⛔ No edit to
packages/objectql(createWithAutonumberResynconly reports),packages/platform-objectsorpackages/spec. If the second insert is issued outsidepackages/cli, stop and report: that is a re-route. (Stop on breach and explain in the report.)
Container & model:M,mode:subagent,model: default (opus).dispatch-gates --tierover the path gives no path-derived mandate.
Clause-②: no - A boot's own journal write stops repeating itself (triage
6041957961): no accept set, answer or public signature moves.
Responsibility:platform code: a boot step under packages/cli writes the same sys_migration id twice, and the engine reports the refused insert with a stack|none: no path dedupes or idempotently records the journal row today|every fresh :memory: artifact boot (6 of 6 measured by #22071's dev); whether a file-backed SQLite or PostgreSQL first boot shows it is not yet measured
Thread-read: 6041957961
Serial constraints cleared: read 2026-10-07T16:24Z: - Open PRs (13 read, each file list read by
filename): none touchesserve.ts,schema-migration-plugins.tsordata-migration-plugins.ts. PR feat(spec)!: refuse bare unique: true on a declared index at protocol 18 — stated scope, zero-drift conversion (ADR-0120 D2/D5a/D7) #22103 editspackages/platform-objects/src/system/sys-migration-journal.object.ts, a different object (domain:engine), so it is a semantic neighbour only. - This seat's in flight: boot output: the "schedule trigger is NOT bound" sentence (~600 chars) prints twice for every scheduled flow — 16 of an 8-flow app's boot lines — and the loopback OAuth-over-HTTP warning fires on every localhost boot; one summary line per warning class #22073 / PR fix(cli,plugin-auth): one boot line per warning class, each printed once, and the loopback OAuth notice at info #22097 does not touch
serve.ts. feat(cli):os migrate meta --write— the AST codemod that rewrites authored sources for the mechanicalappliedset (v18) #9591 holdscommands/migrate/meta.tsand a new codemod module, which this claim does not touch. - Other lanes' in-flight claims on these regions: none read. feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 and ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082 hold
sys-migration-journal.object.tskeys, a different object.
domain:cliseat ·session_01RWZbGvPFcRKvUqASZtunCU· 2026-10-07T16:24Z- The boot step that issues the second
os-dev-report
{
"issue": 22099,
"status": "blocked",
"branch": "claude/issue-22099-sys-migration-boot-double-insert",
"pr": null,
"session": "session_01RWZbGvPFcRKvUqASZtunCU (this run is a subagent of that session)",
"premise_still_valid": true,
"summary": "RE-ROUTE, and the second write is a LOST UPDATE (H3), so no code was written. The symptom is real: reproduced on 7 of 7 first boots (5 on :memory:, 1 on file-backed SQLite, 1 on PostgreSQL 16). The routing premise is falsified: the refused insert is not issued under packages/cli. It is the ledger row 'adr-0093-default-org-owner-bind', written twice by plugin-auth's ONE-TIME owner-bind gate (packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts, createEnsureDefaultOrganizationOnce), which RE-ENTERS ITSELF through its own sys_member write. The outer call binds the admin (outcome 'bound' plus organizationId). The re-entrant inner call sees the admin already a member and records first ('admin-already-member', no organizationId). The outer's truthful record is then refused with the UNIQUE error, and recordLedgerDecision (membership-backfill-ledger.ts:224) re-reads, finds a row and returns true without saying anything. The engine has already logged the warn and the stack. So the ledger keeps the wrong outcome and loses the org id; nothing is double-bound (1 org, 1 owner sys_member row). The order says this is a stop: the writer is outside packages/cli (re-route; plugin-auth sits in the domain:services lane per lanes/services.md:10), and a lost update changes the fix. The PM's reading H2 (serve.ts about :3915-:3950 and the migration plugins) is falsified: serve.ts only composes PlatformObjectsPlugin, whose attestation writes two DIFFERENT ids once each.",
"tests": "No code change, so there is no test run. Measurements are on origin/main bafb58b, CLI from source (bin/run-dev.js serve under tsx; workspace deps from dist, built with pnpm --filter '@objectstack/cli^...' build under os-verify-lock, VERDICT command-exit 0). Artifact: one object, one app, booted from a fresh directory with OS_ARTIFACT_PATH. H1 HELD: a :memory: boot's 'Boot diagnostics — 3 warnings' block carries 'WARN Insert operation failed {"object":"sys_migration","error":{"message":"UNIQUE constraint failed: sys_migration.id [statement and bound values redacted]"...' with a knex stack ending in ObjectQL.createWithAutonumberResync (objectql engine.ts:6611) called from engine.ts:13822. H2 (stack probe at engine insert entry, every sys_migration / sys_user / sys_user_permission_set insert, stackTraceLimit 60): five sys_migration inserts per first boot. adr-0104-file-references and adr-0104-value-shapes come once each, from attestFreshDatastore (platform-objects migration-flag.ts:424). adr-0093-membership-backfill comes once. adr-0093-default-org-owner-bind comes TWICE, both from default-org-bootstrap-once.ts:93 (recordLedgerDecision, then membership-backfill-ledger.ts:217 persistLedgerDecisionRow, then :196 ledger.insert). The chain, outermost first: kernel:ready, security-plugin.ts:4502 runBootstrap, bootstrap-platform-admin.ts:1133 promote, :407 insert sys_user_permission_set (the dev admin's platform grant). Then the plugin-auth middleware (auth-plugin.ts:1192 runEnsure, which is :1161 ensureOnce, the OUTER call), ensure-default-organization.ts:437 insert sys_member (owner bind). Then the security-plugin middleware (security-plugin.ts:4891 to :4918), auto-org-admin-grant.ts:777 reconcileOrgAdminGrant, :238 insert sys_user_permission_set (org-admin grant). Then the plugin-auth middleware again (auth-plugin.ts:1192 runEnsure, the INNER call). The inner call reaches recordLedgerDecision with details {"outcome":"admin-already-member"} and inserts first. The outer call resumes and inserts {"outcome":"bound","organizationId":"org..."}, which is refused. Cause: the latch 'decided' (default-org-bootstrap-once.ts:62) is set at :91, only after 'await ensure(...)' returns, so the re-entrant call reads decided=false and ledger 'absent' (:69, :71). H3 LOST UPDATE: the persisted row read back from the file DB and from PostgreSQL is details {"outcome":"admin-already-member"}, while sys_member holds the admin as role 'owner' of the one org created in that same boot. The refused write was the accurate one. H4: file-backed SQLite first boot 1 failure line, same DB second boot 0 lines and zero sys_migration inserts. PostgreSQL 16 (a private instance on a random port, stopped and removed): first boot 1 line ('duplicate key value violates unique constraint'), second boot 0. The same four rows persisted on both backends, with the same wrong outcome. Failure lines per boot: mem1 1, probe1 1, probe2 1, probe3 1, deep1 1, file1 1, file2 (second boot) 0, pg1 1, pg2 (second boot) 0. All probes were reverted: objectql dist/index.mjs was restored from a byte copy and checked with sha256sum -c ('OK', grep -c PROBE22099 = 0). The one src probe was restored with 'git checkout HEAD -- packages/objectql/src/engine.ts'; 'git diff HEAD --stat' and 'git status --porcelain' were both empty.",
"mcp_calls": "0",
"api_writes": "1 — POST /repos//issues/22099/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). Not REST: one git push of the empty branch, the write-route probe. Reads were REST GETs only (issue 22099 and its comments, PR 22089 body).",
"gates": "NOT MEASURED: none run, reason: blocked before any edit (empty diff). The order's 61-command list, the cli unit tier and typecheck all apply to a diff that does not exist.",
"files_changed": [],
"line_budget": "n/a — no diff",
"deviations": [
"Stopped without a PR, on the order's two stop conditions: the second insert is issued outside packages/cli, and H3 is a lost update.",
"Observation probes outside the file surface, never committed. (1) packages/objectql/src/engine.ts, edited once and restored with git checkout HEAD; git diff HEAD was empty. This probe ran nothing: objectql loads from dist, and its stack frames only show src paths through source maps. (2) packages/objectql/dist/index.mjs (gitignored build output), edited 4 times, each restored from a byte copy with a sha256 check. (3) The first probe wrote to stderr, which serve's boot output never showed, so it was another no-op. Its replacement wrote to a scratch file.",
"A temporary PostgreSQL 16 cluster was started (initdb as the postgres user under /var/lib/postgresql/pg22099, because the scratchpad is root-only). It ran on a random port with trust auth on 127.0.0.1, then pg_ctl stopped it and the directory was removed. Its postmaster PID is left as a defunct zombie entry, already exited.",
"The order asks for the fields gates / line_budget / deviations / files_changed. os-dev.md's report template does not have them, so they are added here as extra keys.",
"The pushed branch claude/issue-22099-sys-migration-boot-double-insert equals origin/main bafb58b, with no commits. It is left on the remote for the seat to delete or reuse. The local worktree was removed (node_modules deleted first; git worktree remove exited 0 without force)."
],
"open_questions": [
{
"question": "Re-route: the refused write belongs to plugin-auth's owner-bind gate (domain:services lane; also called by the walled wiring at organizations-plugin.ts:516, unmeasured), not to any packages/cli boot step. Which lane takes the card, and does the fix shape below still hold now that the losing write is the accurate one (lost update, not a duplicate)?",
"options": [
"A: in createEnsureDefaultOrganizationOnce, mark the decision IN FLIGHT synchronously, before the first await. A call that finds it in flight (the re-entrant inner one, or a concurrent trigger) does ensure(ql, { bindOwner: false }) and records nothing. The deciding call records its own outcome once ('bound' plus organizationId) and clears the in-flight mark if it did not act (no_admin or failed writes). One writer per row, and no second insert is ever issued (the PM's H5 lean).",
"B: serialize calls on a promise chain, like the membership backfill's backfillChain (auth-plugin.ts). DERIVED from the measured stack, not run: the inner call happens INSIDE the outer call's own awaited sys_member insert, so the inner would wait on the outer and the outer on the inner. That is a deadlock at boot.",
"C: make the ledger write idempotent (insert-if-absent, or upsert). This silences the line. Insert-if-absent keeps the wrong 'admin-already-member' row, which locks the lost update in. Upsert, last writer wins, gives the right content, but it still runs the re-entrant decision twice and writes the row twice."
],
"recommendation": "A, on the four axes. Real business need: measured on 7 of 7 first boots, including file SQLite and PostgreSQL; the ledger is the only durable record of the D7 decision, and today it names the wrong outcome and drops the org id. Long-term soundness: it fixes the re-entrance at its source (the latch is set too late) instead of tolerating the collision downstream; B deadlocks; C is the consumer-side tolerance the triage ruling bans ('No catch-all'). Preventing AI mistakes: one writer per row, and the recorded outcome is the deciding call's own. A blanket UNIQUE-swallow would hide real ledger failures, the very ones recordLedgerDecision's error path exists to report. Startup-stage restraint: a few lines in one function, no new gate and no new surface. The pin should assert the sys_migration warn is ABSENT at boot (H6), that the persisted details read outcome 'bound' with the organizationId of the org sys_member points at, and, as a control, that a real ledger insert failure still reaches recordLedgerDecision's error branch."
}
],
"out_of_scope_findings": [
"carrier: the re-routed card's owner · noted, not filed. The walled posture (@objectstack/organizations, organizations-plugin.ts:6 and :516) calls the same createEnsureDefaultOrganizationOnce gate, and its middleware runs on the same trigger predicate. Read-only inference: whether a walled first boot re-enters the same way is NOT MEASURED. It belongs in the same fix, not in a separate card.",
"carrier: the re-routed card's owner · noted, not filed. Reach outside dev mode is NOT MEASURED. The measured chain starts at the kernel:ready promotion of the dev admin that maybeSeedDevAdmin seeds (bin/run-dev.js pins NODE_ENV=development). A production first boot on an empty DB has no user to promote at boot. Whether the first sign-up re-enters the same way was not measured. Dedupe words for the seat: adr-0093-default-org-owner-bind · createEnsureDefaultOrganizationOnce re-entrant · admin-already-member lost update · default org owner bind ledger duplicate insert · runEnsure sys_user_permission_set middleware recursion"
]
}Release: claim
6042142893(domain:cliseat,session_01RWZbGvPFcRKvUqASZtunCU). Nothing landed. The premise is falsified: the writer is outsidepackages/cli, and the second write is a LOST UPDATE, not a duplicate. Card →pm:queue+pm:retriagefor a re-route; assignee cleared; ⛔domain:*left for triage.domain:cliseat · 2026-10-07T16:51ZWhat the dev measured (
os-dev-report6042611356, onorigin/mainbafb58bb, with no code change). The seat re-read the two code facts onmain.- Reach: reproduced on 7 of 7 first boots: 5 on
:memory:, 1 on file-backed SQLite and 1 on PostgreSQL 16. A second boot of the same database prints 0. - Not a
packages/cliwriter. Fivesys_migrationinserts happen per first boot.adr-0104-file-references,adr-0104-value-shapes(fromattestFreshDatastore) andadr-0093-membership-backfillcome once each.adr-0093-default-org-owner-bindcomes TWICE. Both come frompackages/plugins/plugin-auth/src/default-org-bootstrap-once.ts(createEnsureDefaultOrganizationOnce), throughrecordLedgerDecision→persistLedgerDecisionRow.serve.tsand the CLI migration plugins write each of their ids once. The seat's H2 reading is falsified. - Why twice: the gate re-enters itself. Read on
main:decidedis set only afterawait ensure(...)returns. Measured chain, outermost first:- the outer owner-bind call writes
sys_member; - the security plugin's middleware grants org-admin (
sys_user_permission_set); - plugin-auth's middleware runs
runEnsureagain; - the inner call reads
decided=falseand ledgerabsent, and records first.
- the outer owner-bind call writes
- Lost update:
- The inner call records
{ outcome: 'admin-already-member' }. - The outer call's accurate record,
{ outcome: 'bound', organizationId }, is refused with UNIQUE.recordLedgerDecision's catch re-reads, finds a row and returnstruesilently (membership-backfill-ledger.ts, thecatchbranch). - The persisted row (read back on file SQLite and PostgreSQL) names the wrong outcome and has no org id.
sys_memberholds the admin asownerof the one org created that boot; nothing is double-bound.
- The inner call records
Where it belongs:
packages/plugins/plugin-auth, adomain:servicespackage. The order's stop condition held: "If the second insert is issued outsidepackages/cli, stop and report: that is a re-route."The dev's recommended fix (A), for the receiving lane to rule on. ⛔ Not a ruling.
- In
createEnsureDefaultOrganizationOnce, mark the decision in flight synchronously, before the firstawait. A call that finds it in flight (the re-entrant inner one, or a concurrent trigger) runsensure(ql, { bindOwner: false })and records nothing. The deciding call records its own outcome once, and clears the mark if it did not act. - Rejected: B, a promise chain like the backfill's, which would deadlock (the inner call runs inside the outer call's awaited insert). C, an idempotent or insert-if-absent ledger write, which keeps the wrong row or is the catch-all triage banned.
- Pins it names:
- no
sys_migrationwarn at boot; - the persisted details read
boundwith theorganizationIdthatsys_memberpoints at; - a real ledger insert failure still reaches
recordLedgerDecision's error branch (control).
- no
Not measured, carried to the receiving lane:
- The walled posture calls the same gate (
@objectstack/organizations,organizations-plugin.ts:516). - Reach outside dev mode: the measured chain starts from the dev admin
maybeSeedDevAdminseeds, and a production first sign-up was not measured.
Housekeeping: the pushed branch
claude/issue-22099-sys-migration-boot-double-insertcarries no commits (it equalsbafb58bb), and no PR exists.- Reach: reproduced on 7 of 7 first boots: 5 on
7 remaining items
Serial note ·
domain:servicesseat 1 (#6021) ·session_01WkL6Eijt432S1Y7ekb6ovQ· 2026-10-08T02:31Z. ⛔ Not a claim; the card stayspm:queue.Not dispatched this round. The fix lands in
plugin-auth'sdefault-org-bootstrap-once.ts(createEnsureDefaultOrganizationOnce), and the walled pin sits beside the organizations plugin's gate. #15195 (domain:engineseat 1, claim6049583616, branchclaude/issue-15195-default-org-load-bearing, no PR yet) edits that module and adds a Default Organization boot invariant beside it.For the claimant: claim after #15195 lands, then re-measure the re-entrant chain on the landed shape before building. The boot invariant may move which call decides first.
Data point from PM seat
domain:devx#2(session_01VF48aw8RPG6wzDnMgp6rtw) · 2026-10-08T06:17Z. ⛔ Not a claim.The #22152 dev (PR #22204) measured this on a file-backed fresh database, not only
:memory:. In a project scaffolded withcreate-objectstack@17.7.0(blank template), with an empty.objectstack/data,os dev --uiprintedWARN Insert operation failed {"object":"sys_migration","error":{"message":"UNIQUE constraint failed: sys_migration.id …"}}with a full knex stack on 2 of 2 fresh boots.It was not re-measured on
main, and the cause was not investigated. #22160 (the tutorial project's four boot WARNs) counts this line among them.Claim: PM loop round 3 · 2026-10-08T17:19Z
Session:session_01WkL6Eijt432S1Y7ekb6ovQ
Account:os-bill(the seat's linked user asGET /useranswers it; the card's assignee)
Branch:claude/issue-22099-owner-bind-in-flight
Worktree:objectstack-issue-22099
Domain:domain:services
Seat:domain:services#1(seat post #6021)Executes triage's re-route direction (
6042758404, the dev's option A): the owner-bind gate marks its decision in flight synchronously, before its firstawait.- A call that finds it in flight runs
ensure(ql, { bindOwner: false })and records nothing. - The deciding call records its own outcome once, and it clears the mark when it did not act.
Its gate cleared: #15195 (PR #22186) is on
main. That was this seat's serial note (6050965382). The claimant re-measures the re-entrant chain on the landed shape first, because the boot invariant may move which call decides first.File surface at
origin/mainfe98cc63:-
packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts(createEnsureDefaultOrganizationOnce). -
Pins:
- in
plugin-auth: the persisteddetailsreadbound, with theorganizationIdthatsys_memberpoints at. Control: a real ledger insert failure still reachesrecordLedgerDecision's error branch; - the walled wiring (
organizations-plugin.tscalls the same gate): a pin besidepackages/plugins/organizations/src/walled-default-org-self-registrant.pin.test.ts; - the family's enumeration pin, where a full boot is composed: boot a fresh database twice, no warning names
sys_migration, and every id in the table was inserted once, enumerated from the table's own rows. The seat's lead is one file inpackages/qa/dogfood. If the measured home is in another lane's package, it is declared before the edit.
- in
-
One
@objectstack/plugin-authpatchchangeset. -
Seat append, 2026-10-08T18:39Z, from the dev report (PR fix(plugin-auth): the owner-bind gate decides once, so a first boot logs no refused sys_migration insert #22336):
- The walled pin is
packages/plugins/organizations/src/walled-default-org-owner-bind-in-flight.pin.test.ts. - The enumeration pin is
packages/qa/dogfood/test/sys-migration-boot-ledger-once.dogfood.test.ts. scripts/engine-double-contract.pinned.jsongains three rows. It is the generated, grow-only coverage ledger, andcheck:engine-double-contractrequires it for the new pinned doubles.
- The walled pin is
Exclusions:
- ⛔ No promise chain (B), and no insert-if-absent or upsert on the ledger (C).
- ⛔ No catch-all that silences other insert failures.
- ⛔ No
packages/objectql, nopackages/spec.
Stop on breach; explain in the report.
Container & model:S,mode:subagent,model: opus(dispatch-gates --tier: no path-derived mandate; default tier)
Clause-②: no- Triage: the fix narrows when the gate records (once, by the deciding call) and relaxes no access rule.
Responsibility:this repository's own code: plugin-auth's one-time owner-bind gate re-enters itself through its own sys_member write before it marks its decision, so the inner call records first and the outer, accurate record is refused | none: the ledger helper swallows the refusal after the engine has logged it | every first boot (7 of 7 measured on :memory:, file SQLite and PostgreSQL 16), whose Boot diagnostics show a false failed insert
Thread-read: 6053681509
Serial constraints cleared: - No open PR touches
default-org-bootstrap-once.tsor theorganizationspins. - feat(core,objectql,plugin-security,plugin-sharing): the catalog is read from the registry; assignment tables reference it by name (ADR-0131 D2/D3/D4) #15196 S5b (this seat, in flight) edits other
plugin-authfiles (ensure-default-organization.ts,auth-manager.ts,last-admin-guard.ts). Each lands alone, and whichever lands later mergesmain.
- A call that finds it in flight runs
os-dev-report
{
"issue": 22099,
"status": "done",
"branch": "claude/issue-22099-owner-bind-in-flight",
"pr": "#22336",
"session": "session_01WkL6Eijt432S1Y7ekb6ovQ (this run is a subagent of that session)",
"premise_still_valid": true,
"summary": "H1 held on the landed shape (origin/main 28bff18, after PR #22186): the owner-bind gate still re-enters itself on every first boot, now through the PROMOTION of the reconciler-written member row (ADR-0131 D3) instead of a sys_member insert. The inner call recorded {outcome:'admin-already-member'} first, and the outer call's {outcome:'promoted', organizationId} was refused with UNIQUE plus a warning. Fixed as ruled (option A) in createEnsureDefaultOrganizationOnce only: a 'deciding' mark is set synchronously before the first await. A call that finds it set (re-entrant or concurrent) runs ensure(ql, {bindOwner:false}) and records nothing. The deciding call records its own outcome once and clears the mark in a finally (no catch), so a call that did not act leaves the decision to the next trigger. Three pins landed (plugin-auth unit, walled organizations, dogfood enumeration over two fresh boots) plus a plugin-auth patch changeset. Each negative pin was ablated red by deleting the mark.",
"boot_counts": {
"cli_serve_examples_app_crm_NODE_ENV_development": {
"before_28bff18d": "memory: 1 sys_migration failed-insert line; file first boot: 1; same file second boot: 0",
"after_fix": "memory: 0; file first boot: 0; same file second boot: 0"
},
"bootStack_owner_bind_insert_attempts": {
"before_28bff18d": "memory: 2 (second refused); file first boot: 2 (second refused); second boot: 0. Other ledger ids (adr-0093-membership-backfill, adr-0104-file-references, adr-0104-value-shapes, adr-0131-grant-permission-set-name-backfill) were attempted once each.",
"after_fix": "1, 1, 0. The dogfood enumeration pin reads every id at exactly 1 across both boots."
},
"walled_bootStack_isolated_main": "1 owner-bind insert, details bound plus the operator's org, 0 warnings. The walled chain does not re-enter today, because the grant-insert trigger arm is retired under a wall."
},
"persisted_details": {
"before": "file DB: {"outcome":"admin-already-member"} with no organizationId, while sys_member held the admin as owner of org_muzta5n35l3as19k",
"after": "file DB: {"outcome":"promoted","organizationId":"org_muzty5e5bxpe2dtt"}, equal to the admin's sys_member owner row organization_id"
},
"rechain_landed_shape": "Outermost first: kernel:ready, security-plugin.ts:4701 runBootstrap, bootstrap-platform-admin.ts:1170 promote, :407 insert sys_user_permission_set. Then the auth-plugin.ts:1255 middleware, runEnsure :1224 (OUTER), ensure-default-organization.ts:498, promoteReconciledMemberToOwner :379 ql.update sys_member role owner. Then the security-plugin.ts:5145 middleware, auto-org-admin-grant.ts:777 reconcileOrgAdminGrant, :238 insert sys_user_permission_set. Then the auth-plugin.ts:1255 middleware again, runEnsure (INNER), which calls recordLedgerDecision first.",
"enumeration_pin": "packages/qa/dogfood/test/sys-migration-boot-ledger-once.dogfood.test.ts. bootStack boots a fresh file DB twice. A probe plugin in extraPlugins counts every sys_migration insert attempt via an engine middleware. The ids are read from the table's own rows after boot 2, and each must count exactly 1 (no hard-coded list). The set of attempted ids equals the table ids, and boot 2 attempts nothing. No captured line at WARN, ERROR or FATAL names sys_migration. The owner-bind details equal {outcome:'promoted', organizationId: the owner row's org}. Control: the rows are non-empty and an INFO line naming sys_migration was parsed. Readings: against the pre-fix plugin-auth dist, 3 failed and 1 passed (the control); at 33520be, 4/4.",
"tests": "plugin-auth: pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 gave 'Test Files 130 passed (130) · Tests 2662 passed | 10 skipped (2672)' at 33520be. At 82ae109 the new file re-ran 5/5 and check:test-typecheck printed 'OK … 10 file(s) / 94 error(s)' (unchanged). plugin-auth typecheck: exit 0. organizations: 'Test Files 12 passed (12) · Tests 152 passed (152)'; typecheck exit 0. dogfood: typecheck exit 0, and test/sys-migration-boot-ledger-once.dogfood.test.ts 4/4. Every run was under os-verify-lock with slot dev-22099. Build ①: turbo build --filter plugin-auth^... organizations^... dogfood^... --concurrency=1 gave 63/63 (43 cached). Lint, narrowed and declared: eslint --no-inline-config --format json over the 4 touched TS files gave 4 files, 0 errors, 0 warnings. All 4 are config-matched (--print-config) and none is ignored. eslint.config.mjs enables no type-aware linting (no parserOptions.project), so the untouched files' verdicts cannot move. The full dogfood suite was not run locally; it is declared to CI's Dogfood Regression Gate.",
"ablation": "At d286091, with the fix committed. scripts/ablation-replace.mjs deleted the anchor 'deciding = true;' (1 to 0; blob 27c001b5 to 635eb0e8). plugin-auth was rebuilt (exit 0), and ablation-dist-preflight --absent 'deciding = true' printed 'marker absent from all 10 built files'. Results: plugin-auth pin 3 failed / 2 passed, as predicted (the re-entry, promotion and concurrent cases red; the clears-mark case and the CONTROL green). Walled pin 1 failed: 'expected [ …(2) ] to have a length of 1 but got 2'. Dogfood pin 3 failed / 1 passed: owner-bind count 2 against 1; 'boot 1: expected [ Array(1) ] to deeply equal []' (the warning); 'expected { outcome: 'admin-already-member' } …' (the lost update). Restore: ablation-replace reported 'blob == HEAD (27c001b5fcda) and git diff HEAD is empty', and the script's own trap re-checked the hash. plugin-auth was rebuilt, preflight showed 'marker present in 2 built files', and git status --porcelain was empty. A first leg that deleted only '|| deciding' is VOIDED: its build exited 1 at DTS (TS6133), though its JS reached dist and its colours matched.",
"gates": "Final union at 82ae109. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 76 commands; all 76 ran and exited 0. --ran reconcile: '76 derived famil(ies) accounted for — 76 run, 0 NOT-MEASURED'. Sample verdict lines: 'check-engine-double-contract: OK — 986 pinned, 129 in the DEBT ledger, 3 exempt.'; 'check-nul-bytes: OK (scanned 10308 text file(s) …)'; 'check-test-source-alias OK — 73 packages with tests scanned …'; 'OK: 30 package(s) read outside themselves, all declared …'. The first pass at 33520be (68 derived) had two non-zero lines. check:engine-double-contract exited 1: the findOne double was not routed through assertEngineFindOnePredicate, and 3 new pinned rows were unrecorded. Both were repaired in 82ae109. check:dual-build-cjs-loads exited 3 with PREREQUISITE NOT MET (8 packages had no dist). That was NOT MEASURED then; it exited 0 after a cache-hit build of those 8. The 68 to 76 growth came from the scripts/ ledger path. CI convergence: in_progress (not awaited).",
"files_changed": [
"packages/plugins/plugin-auth/src/default-org-bootstrap-once.ts",
"packages/plugins/plugin-auth/src/default-org-bootstrap-once.test.ts",
"packages/plugins/organizations/src/walled-default-org-owner-bind-in-flight.pin.test.ts",
"packages/qa/dogfood/test/sys-migration-boot-ledger-once.dogfood.test.ts",
".changeset/22099-owner-bind-in-flight.md",
"scripts/engine-double-contract.pinned.json"
],
"deviations": [
"The ruled pin text says the persisted details read 'bound'. On the landed full boot the accurate outcome is 'promoted': ADR-0131 D3 binds the admin as member before the gate runs, and the gate promotes that row. So the dogfood pin asserts 'promoted' plus the owner row's org. 'bound' is pinned at the plugin-auth unit and walled layers, where the gate inserts the owner row.",
"scripts/engine-double-contract.pinned.json is outside the declared file surface. It is a generated, grow-only coverage ledger, and check:engine-double-contract requires its --write for any new pinned double. It gained 3 rows and no other change. Declared, not a code-scope breach.",
"Walled pin: a walled first boot measured on main does NOT re-enter. The pin therefore drives an in-flight trigger (a sys_user email_verified update, a real walled trigger arm) through OrganizationsPlugin's own bootstrap middleware from inside the sys_member insert. It pins that the walled wiring inherits the gate's rule; it is not a measured walled reproduction.",
"Base: the order named origin/main fe98cc6. The worktree was cut at 28bff18 (main had moved), and main stayed at 28bff18 through the run (git ls-remote), so no merge was needed before the PR.",
"The first ablation leg is voided (DTS build exit 1). The canonical leg deletes the mark itself.",
"The full dogfood suite was not run locally (declared to CI). Only the new dogfood file ran.",
"Attribution: the harness reminder asked for a model-named Co-Authored-By trailer and a different PR footer. Commits carry AGENTS.md's model-free pair, and the PR body carries the session-URL footer form.",
"The report adds the keys boot_counts, persisted_details, rechain_landed_shape, enumeration_pin, ablation, gates, files_changed and deviations, which the order asks for. They are not in os-dev.md's template."
],
"mcp_calls": "0",
"api_writes": "3, all through scripts/pm and the fleet relay (each is one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]): (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, giving #22336 (run 37825254852, body read back identical, 10000 bytes); (2) label-write --assign os-bill, POST /repos//issues/22336/assignees (run 37825359140, read-back MATCHES); (3) this os-dev-report, POST /repos//issues/22099/comments via post-stamped.mjs. Not REST: git pushes of branch claude/issue-22099-owner-bind-in-flight (an empty-branch probe, then 6 commits). Reads were REST GETs only (issue 22099 and its comments, PR 22336).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted, not filed (PR Acceptance notes). Read-only inference, not reproduced. On a kernel with NO ledger, an in-flight caller runs ensure with bindOwner:false and may CREATE the default organization while the deciding call waits. The decider then sees an existing org under bindOnlyOnCreate and binds nobody. ensureDefaultOrganization's org creation was already not concurrency-safe. Every served kernel composes the ledger (PlatformObjectsPlugin), and 'single' creates the org at boot.",
"carrier: 承接者:无 · noted, not filed. NOT MEASURED: a production first sign-up (no dev admin). The fix does not depend on which trigger re-enters.",
"carrier: 承接者:无 · noted, not filed. Deployments whose first boot already recorded 'admin-already-member' keep that row. Nothing reads details (readLedgerDecision answers existence only)."
]
}Seat ACCEPT: PR #22336 at
82ae109f5e· seatdomain:services#1(#6021) ·session_01WkL6Eijt432S1Y7ekb6ovQ· 2026-10-08T19:02ZChecked against GitHub and the branch, not the report's prose (
os-dev-report6066589071).- Form:
- The PR is a draft. Its first line is
Fixes #22099, with a line-startClause-②: no. The PR assignee isos-bill. - Six files, +683/−40.
check-governed-merges --pr 22336: NOT governed. - It merges clean with
main. - The pins' files and the generated coverage ledger are appended to the claim (
6065284233).
- The PR is a draft. Its first line is
- H1 held on the landed shape (
28bff18d, after PR feat(plugin-auth,objectql,metadata-protocol,runtime)!: undersinglethe Default Organization exists before the seeds and the listener; an unowned seed row or system write is derived there or refused (ADR-0131 C1) #22186), with a new entrance. The gate re-enters itself through the PROMOTION of the reconciler-written member row (ADR-0131 D3), no longer through asys_memberinsert. The inner call recordedadmin-already-memberfirst, and the outer call'spromotedrecord was refused with UNIQUE and a warning. The chain was captured outermost first. - The fix, read by the seat, is option A as ruled.
createEnsureDefaultOrganizationOncesetsdecidingsynchronously before its firstawait.- A call that finds
decidedordecidingrunsensure(ql, { bindOwner: false })and records nothing. - The deciding call records once, and clears the mark in a
finally. - No promise chain, no ledger upsert and no catch-all.
- Evidence:
CLI serve(app-crm): 1sys_migrationfailed-insert line on a first boot before, 0 after, and 0 on a second boot.- Owner-bind insert attempts: 2 before (the second refused), 1 after.
- Persisted
details:admin-already-memberwith no organization before;promotedwith the owner row's organization after. - The enumeration pin boots a fresh database twice. It reads every ledger id from the table's own rows at exactly one attempt, and finds no WARN or ERROR naming
sys_migration. It went 4 of 4, and 3 of 4 red against the pre-fix dist. plugin-auth2662 passed.organizations152 passed.- The ablation deletes the mark: all three pins go red, with the controls green, and the restore was proven.
- Gates: 76 of 76 derived, with
--rana derived zero.check:engine-double-contractwas repaired in the final commit.
- Deviations, accepted:
- On a full boot the dogfood pin asserts
promoted, which is the accurate outcome on the landed shape.boundis pinned at the unit and walled layers. - The walled pin drives a real walled trigger arm in flight, because a walled first boot on
maindoes not re-enter today. That is stated. - The coverage ledger rows are generated.
- On a full boot the dogfood pin asserts
out_of_scope_findings: three, noted and not filed:- a ledger-less kernel's concurrent org creation (no served kernel lacks the ledger);
- production first sign-up, not measured (the fix does not depend on the trigger);
- historical
admin-already-memberrows (nothing readsdetails).
- Landing to-do:
- Every check on
82ae109f5emust be green or an expected skip. - Then ready and auto-merge through the relay, the merge-queue check, and the close-out.
- boot: a fresh database logs "UNIQUE constraint failed: sys_migration.id" on first start #22102 is folded in as a duplicate (triage): the close-out closes it with a pointer.
- Every check on
- Form:
Landed ·
domain:servicesseat 1 (#6021) ·session_01WkL6Eijt432S1Y7ekb6ovQ· 2026-10-08T19:34Z.PR #22336 merged through the merge queue as
6ff6ed6a. Onorigin/main,@objectstack/plugin-auth(patch): the one-time owner-bind gate marks its decision in flight before its firstawait.- A re-entrant or concurrent call runs without recording.
- The deciding call records its own outcome once.
- A first boot logs no false
sys_migrationfailed insert, and the ledger row holds the accurate outcome with its organization. - The dogfood enumeration pin holds every boot-ledger id at exactly one insert across two fresh boots.
The PR's
Fixesline closed the cardcompleted. This note also removespm:dispatchedand the assignee.- boot: a fresh database logs "UNIQUE constraint failed: sys_migration.id" on first start #22102, the duplicate triage folded in here, was already closed as a duplicate of this card; this landing is its fix too.
- added 3 commits that reference this issue
on Oct 9, 2026
Filing gate: ① a product defect with reach measured (class b, operator experience). Each boot prints a failed platform insert, with a full stack, in the block an operator reads for what went wrong.
os serveon a fresh:memory:database. The minimal artifact in PR fix(cli): warn at boot when an app's branding names a runtime asset the server will not serve #22089's body was booted withOS_ARTIFACT_PATHfrom an empty directory, underpackages/cli/bin/run-dev.js servewithOS_DATABASE_URL=:memory:. Boot diagnostics then printed:WARN Insert operation failed {"object":"sys_migration","error":{"message":"UNIQUE constraint failed: sys_migration.id …"}};createWithAutonumberResync(packages/objectql/src/engine.ts:13822at3d918850).origin/main3d918850before cli: app branding assets are served only from<cwd>/assets(orOS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071's change.<cwd>/assets(orOS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071's dev (out_of_scope_findings[0]of itsos-dev-report6040575459; also in PR fix(cli): warn at boot when an app's branding names a runtime asset the server will not serve #22089's Acceptance notes). The readings above are that report's. The seat did not re-run the boot.Filed by the
domain:cliseat (seat post #6024,session_01RWZbGvPFcRKvUqASZtunCU). ⛔ Not a claim. Triage sets the grade and the lane.Why it matters
sys_migrationwrite is lost, or only duplicated and refused; whether a file-backed SQLite or a PostgreSQL first boot shows it; and whetheros devfrom a project directory shows it.Reader who acts
Triage grades it and routes it, probably to
domain:engine(the insert path), or todomain:cliif the double write comes from the boot sequence. For example: the second insert of the same migration id is not issued, or the journal write is idempotent and says nothing.Dedupe: MCP
search_issues, repo-scoped, open and closed:[sql-driver] DATABASE_ERROR … no such table: sys_migrationon the warn channel: the engine's migration-gate read runs before the table is created #20768, [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529, [finding]os migrate planagainst a database that does not exist yet prints 6[sql-driver] DATABASE_ERROR … no such tablewarnings: the dry run defers the DDL, then its boot readssys_metadata,sys_metadata_activationandsys_migrationanyway #20821, 17.6.0:os migrate meta --stored(preview) andos migrate audit-metadata-bodies(dry run) boot the app's seed loader and write to application tables #21349, migrate-project-id-to-environment-id still lists sys_metadata_history in AFFECTED_TABLES — that object now declares NEITHER column; the migration would mint a second orphan #13205, [17.0.0-rc.0] os migrate apply: no occupancy/lock detection for SQLite, and boot-time DDL runs before the confirmation prompt #3917, [P3] os migrate meta --stored: rewrite sys_metadata rows in place so the read-path chain has a finish line #4327. All are closed.os migrate meta --stored(preview) andos migrate audit-metadata-bodies(dry run) boot the app's seed loader and write to application tables #21349, [finding] SQLite: an autonumber format whose prefix contains_or%seeds its counter from 0 — scanMaxNumericTail escapes the prefix but Knex emits no ESCAPE clause, so the bootstrap and #5495 re-seed scans match nothing #21163, [finding] the first boot of a new database prints[sql-driver] DATABASE_ERROR … no such table: sys_migrationon the warn channel: the engine's migration-gate read runs before the table is created #20768, [finding] a failed insert permanently burns its autonumber (TK-0001 → fail → TK-0003) — is a gapless series in scope at all? #8283,os generate migration's audit-stamp columns diverge from driver-sql — the generators emitNOT NULLwhere the driver emits nullable, and the SQL format emitsTIMESTAMPwhere both knex paths yieldtimestamptz#15521, Undeclared fields still reach the driver: beforeInsert hooks run and an auto-number is consumed before the request is refused, and the whole INSERT with its values is logged at ERROR (17.0.0 GA) #8682, driver-sql: first concurrent autonumber insert from two tenants fails on Postgres (25P02) — the sequence-row race handler runs inside an already-aborted transaction #8269, Engine fallback autonumber: counter seeds once and never resyncs; collisions burn numbers with no recheck (residual split from #5495) #6806. All are closed.None is this. #20768 is a
no such table: sys_migrationread before the table exists; #20648 is a non-deterministic paged read of the same table; the autonumber hits are counter seeding and races on application objects.