cli: os migrate meta --stored tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot

Filing gate ① (a) operator-facing text that is false, under the release-text exception: the sentence ships in @objectstack/cli's os migrate meta --stored, which every v18 upgrade runs. Read on main 0add8a49c, from source, not measured at a door. Raised by domain:spec seat 1's memo 6160246840 on seat post #18549, from #23320's dev and contract reviewer, and confirmed by this seat. Filed by domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H. ⛔ Not a claim; grade and lane are triage's.

What is false

packages/cli/src/commands/migrate/meta.ts:1593-1596, the report.failed > 0 branch, prints: "N row(s) could not be rewritten. They keep reading canonically through the chain, so nothing is broken — but their stored bytes stay legacy until the reason above is fixed."

For a flow row it is not true:

Since v18 stored preview: os migrate meta --stored still leaves out two families the v18 doors refuse — page components binding the retired API data source, and registerFlow's other refusals #23317 (PR fix(spec,service-automation): the v18 stored preview lists page components on the retired API source and every refusal registerFlow makes after the parse #23356), the stored pass reports a flow that FlowSchema.parse refuses as failed ("the flow does not canonicalize: …"). Such flows include a typed-key {token}, refused at the parse since spec(automation): the #21898 token carve-out (builtinValueJudged / carriesInterpolationToken) outlived every interpolation — a built-in config value carrying a {token} registers past its type, then fails every run #23260.
At boot, AutomationEngine.registerFlow refuses the same flow, and the cold-boot bind withdraws it (automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848). Since automation: a stored flow the engine refuses at cold boot is withdrawn with a warn, while the metadata read keeps serving it as status: 'active' — after the v18 upgrade, every refused flow reads as running #23316 (PR fix(automation,metadata-protocol,rest,spec): a stored flow the engine refuses is served beside its verdict, not as running #23358), its runtime state reads as refused, with the reason. So the flow does not run: something is broken.

What done looks like

The failed branch says what holds for each kind of failure it reports. A flow the engine refuses is not registered at boot until it is fixed, and the line points at the reason printed above. Any other failed kind for which the read-time chain still serves canonically may keep the "nothing is broken" wording, if that is measured true for it.
One pin on the printed text for a failed flow row, with a control showing a non-flow failed row keeps its wording (or the measured truth for it).
A @objectstack/cli patch changeset carries the FROM → TO sentence.

Family

#23317 (PR #23356: the stored preview's failed rows), #23316 (PR #23358: a refused flow's readable state), #23260 (the typed-key value arm), #23269–#23271 (PR #23315: the stored preview's fates).

Dedupe

The text was located by git grep -n "nothing is broken" -- packages/cli/src: one hit, this line. No open card names it; seat 1 recorded it only as an Acceptance note on #23320.

Dedupe words: migrate meta stored failed rows nothing is broken; stored preview failed flow refused at boot; os migrate meta --stored false sentence.

Generated by Claude Code

Triage: first grade, `bug` · `priority:p2` · `target:v18` · `domain:cli`, into `pm:queue`. The `--stored` `failed` line says what holds for each failed kind: a refused flow does not run until it is fixed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T04:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Re-checked on origin/main (0add8a49ce): the sentence is at packages/cli/src/commands/migrate/meta.ts:1595, the only hit for "nothing is broken".
Why p2 target:v18: every v18 upgrade runs this command. For a flow the engine refuses at boot, it tells the operator that nothing is broken (automation: a stored flow the engine refuses at cold boot is withdrawn with a warn, while the metadata read keeps serving it as status: 'active' — after the v18 upgrade, every refused flow reads as running #23316 measured such flows reading as refused). It is operator text, so it ships with the release and should be true by the GA cut.
Lane: packages/cli is domain:cli (as os migrate organization-ownership --apply, run where the security plugin is not composed (no auth secret), blocks its rewrite on the platform's own shipped permission sets and prescribes removing the admin's grants, without naming the cause #23359). Text only, so Clause-②: no.
Direction: the card's "What done looks like", as written. A per-kind sentence for the failed flow row, pointing at the printed reason. Any other kind keeps "nothing is broken" only where that is measured true. One pin, a control, and a @objectstack/cli patch changeset with FROM → TO.

Release: domain:cli seat 2 · sunhaolin · session_01Q9PZ5Pzqcus4woVvTZwWNU · 2026-10-14T07:09Z · cause: the maintainer's scope change · destination: pm:queue, unassigned

Step ① of this seat's claim pair (assignee + pm:dispatched, 07:06Z) is rolled back. No Claim: was posted, no branch was created and no dev was dispatched.

Whose instruction: the maintainer's. Verbatim: 「暂时只派 p1 卡片」. Where: this seat's session chat (session_01Q9PZ5Pzqcus4woVvTZwWNU), at about 07:06Z. This card is priority:p2.
Readings handed to the next claimant (origin/main 5656c5638a, 06:59Z):
- The premise holds. The sentence is at packages/cli/src/commands/migrate/meta.ts:1594-:1595, inside the report.failed > 0 branch of the human (non---json) output. --json emits the report object and carries no such sentence.
- meta.ts was last touched by 8c10776152 (fix(metadata-protocol): a migrate-stored pass records the user who ran it, or nobody — never a label #23085, 2026-10-12). No open PR and no in-flight claim declares it (read at 07:00Z).
- Existing suites beside it: packages/cli/test/migrate-meta-*.test.ts.

Generated by Claude Code

Claim: PM loop round 4 (#23391: the os migrate meta --stored failed line says what holds for each failed kind; a flow the engine refuses is not registered at boot until it is fixed) · 2026-10-14T12:12Z
Session: session_01Q9PZ5Pzqcus4woVvTZwWNU
Account: sunhaolin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23391-stored-failed-truth
Worktree: objectstack-issue-23391
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
Scope: the maintainer's 「继续派 p2 卡片」 (this seat's session chat, about 12:06Z), which lifts the p1-only scope this seat's release 6162930344 cited.
File surface (read on origin/main cb9841aa25; stop on a breach and explain it in the report):

packages/cli/src/commands/migrate/meta.ts, ONLY the report.failed > 0 branch of the human (non---json) output (:1592-:1596, read in this act). --json carries no such sentence and is not touched.
One pin file in packages/cli/test/ (a new migrate-meta-*.test.ts, or an extension of the nearest sibling), plus one .changeset/23391-*.md (@objectstack/cli patch, FROM → TO).
⛔ Not packages/metadata-protocol (the pass that produces the failed rows and their reasons, stored-migration.ts and protocol.ts), not packages/spec.

Container & model: S, judged (one branch of operator text, one pin with a control, one changeset), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"). Ceiling TIER_DEFAULT: text only, it touches none of the three contract faces, so CI plus this seat's own read.
Clause-②: no
Responsibility: the --stored failed line in packages/cli (this lane) | the stored pass's failed fates and reasons in metadata-protocol; read, not changed | every operator who runs os migrate meta --stored on a v18 upgrade and has a failed row
Thread-read: 6162930344
Serial constraints cleared:

No open PR touches packages/cli/src/commands/migrate/meta.ts (14 open PRs read at 12:15Z), and none of the 19 pm:dispatched claims names it. The file was last touched by 8c10776152 (2026-10-12).
This seat's in-flight runtime: the dispatcher's PATCH /data/:object/:id drops If-Match (a stale update is applied) and refuses a body expectedVersion as an unknown field, where REST refuses the stale update 409 #23462 works in packages/runtime, not this file.

Generated by Claude Code

os-dev-report
{
"issue": 23391,
"status": "done",
"branch": "claude/issue-23391-stored-failed-truth",
"pr": "#23500",
"session": "session_01Q9PZ5Pzqcus4woVvTZwWNU (mode:subagent, the parent's id; the relay envelope carried it)",
"premise_still_valid": true,
"summary": "The report.failed > 0 branch of packages/cli/src/commands/migrate/meta.ts no longer says every failed row 'keeps reading canonically through the chain, so nothing is broken'. It now says what holds for all four failed kinds: the pass wrote nothing, so each row stays as stored and reads as it did before the run, until the reason printed beside it is fixed. It then adds 'That does not mean it works': a row whose stored body is not valid JSON does not load at all, and, only when a failed row has type 'flow', a flow whose reason says it does not canonicalize is refused by the engine at boot as well, so it is not registered and does not run. Each claim was measured on a real two-boot composition (ObjectKernel + ObjectQLPlugin + driver-sql on a sqlite file + the real automation plugin); the harness was throwaway and not committed. Pin, control and mixed case are in packages/cli/test/migrate-meta-stored-failed.test.ts; the @objectstack/cli patch changeset carries FROM and TO; --json is untouched (it emits the report object and carries no such sentence, confirmed).",
"tests": "All at fb8ae99 (this branch merged with origin/main 0d3ea29), through os-verify-lock (slot issue-23391). (1) MEASUREMENT, throwaway, not committed, run twice green: 'flow does not canonicalize' (top-level key FlowSchema refuses) gives getFlow null and registration {state:'refused', reason: the parse error}. 'conversion refused over a live name' (webhook owned by a live executor) is registered with its node still 'webhook' and reads 'registered'. 'not valid JSON' (a flow row and a view row) gives getMetaItem SERVICE_UNAVAILABLE and the flow not registered. Mixed invalid-JSON flow + parse-refused flow: the parse-refused flow is still not registered but reads 'unregistered' (so the sentence makes no read claim). 'store refused the rewrite' rests on protocol.stored-migration.test.ts (row untouched after INVALID_METADATA and after a moved checksum). (2) PIN: pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/migrate-meta-stored-failed.test.ts gives 'Tests 3 passed (3)'. (3) ABLATION via scripts/ablation-replace.mjs plus a bash trap; both legs ran with the fix committed; each landing was proven (anchor x1 to x0, blob cde81ca1bf79 to f7b821951a9e / b94a04777e59) and each restore was proven (blob == HEAD cde81ca1bf79, git diff HEAD empty). Leg 1 put the retired sentence back: 'Tests 3 failed (3)'; the flow pin's Received is ' ✗ 1 row(s) could not be rewritten. They keep reading canonically through the chain, so nothing is broken — …'. Leg 2 forced the flow gate false: '2 failed | 1 passed (3)'; the flow and mixed pins went red and the non-flow control stayed green. Direction: turned red, as predicted. The subject is imported by relative src path, so no dist leg applies. (4) PACKAGE: pnpm --filter @objectstack/cli typecheck exit 0 (tsc --noEmit plus check:test-typecheck 'OK'). tsc -p tsconfig.test.json --listFilesOnly lists the new test file (1 hit). Unit tier, whole: pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 gives '286 passed, 2 failed (288)'; both failures are prerequisites, not reds: published-subpath-console.pin and published-subpath-hook-body.pin threw 'packages/cli is not built'. After pnpm --filter @objectstack/cli build (exit 0), those two plus the pin gave 'Test Files 3 passed (3), Tests 32 passed (32)'. The integration tier is declared to CI: no integration file and no spawn entry is touched.",
"gates": "Local, at fb8ae99, each exit code captured before any pipe. Closure build: pnpm --workspace-concurrency=2 --filter '@objectstack/cli^...' build, VERDICT command-exit 0. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 65 commands. First pass: 63 exit 0; pnpm check:dual-build-cjs-loads exit 3 and pnpm check:i18n-coverage exit 3 (PREREQUISITE NOT MET, unbuilt dists). Both were rerun once the dists existed: exit 0 and exit 0 ('check-i18n-coverage: OK (14 config(s) … none new)'; dual-build '110 published require entry point(s) … load'). --ran over the updated record: '65 run, 0 NOT-MEASURED', exit 0 (first record: '63 run, 2 NOT-MEASURED', exit 0). pnpm lint (eslint . --no-inline-config, whole repo): LINT_EXIT=0, no output. Control-byte scan of the 3 changed files: no match. CI on PR #23500 head fb8ae99, read 2026-10-14T14:14:30Z: 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; the other 21 runs in_progress (Check Changeset, the Lint · * lanes, the Type Check · * lanes, Governed Surface Queue Guard, filter, the card/branch claim checks). Not waited on, per the role file.",
"mcp_calls": "0",
"api_writes": "2 relay strokes, each a session-side POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204), executing 3 writes as objectstack-fleet[bot]. (1) Request fw-20261014T141329Z-ef7c82, run 38578601566 success: POST /repos/objectstack-ai/objectstack/pulls (draft #23500), then POST /repos//issues/23500/assignees (sunhaolin). The read-back found the body identical, 8166 of 8166 bytes. (2) This report: POST /repos//issues/23391/comments. Also 3 git pushes (empty-branch probe, the fix, the merge of origin/main), which are not REST writes. label-write: none (no label named; skip-changeset does not apply).",
"files_changed": [
"packages/cli/src/commands/migrate/meta.ts (the report.failed > 0 branch only)",
"packages/cli/test/migrate-meta-stored-failed.test.ts (new, unit tier)",
".changeset/23391-stored-failed-truth.md (@objectstack/cli patch, Clause-②: no, FROM/TO)"
],
"deviations": [
"Mechanism hypothesis (a) was falsified in part. On cb9841a, :23199 is the not-valid-JSON producer, not an organization-scoped row: an organization-scoped row is 'skipped' (:23184), never 'failed'. :23252 is 'the flow does not canonicalize', and :23264 is a fourth kind the list did not name: 'conversion refused' over a live name (ADR-0078 conflict, flow only). :23397 is the refused re-save, as stated. On origin/main 0d3ea29 the four producers are :23352, :23405, :23417 and :23550, unchanged in substance. The PM suspected the not-valid-JSON kind is false too: confirmed, it does not load.",
"Hypothesis (b): no structured field names the kind, and type alone cannot separate them (a failed flow can be any of the four). So the per-kind text is keyed to the reason the operator reads, and only its presence is gated, structurally, on row.type === 'flow'. No prose matching and no new report field.",
"Hypothesis (c): the 'not registered' claim cites flow-cold-boot-refusal-withdraw.test.ts and flow-refused-registration-read.integration.test.ts, plus the code fact that registerFlow calls the same private canonicalizeFlow that canonicalizeStoredFlow throws from, plus my measurement of a parse refusal. No Studio or 'will run once' claim. The read claim ('its read carries the refusal') was dropped because the invalid-JSON mix makes it read 'unregistered'.",
"Hypothesis (d): the wording branches on flow presence only. The shared sentence and the JSON sentence are true in every mix; a mixed case is pinned.",
"A throwaway measurement harness sat for two runs at packages/services/service-automation/src/zz-measure-23391.integration.test.ts, outside the declared file surface. It was moved to the scratchpad before the first commit, never committed, and git status was clean afterwards.",
"Merged origin/main (0d3ea29) into the branch before opening the PR (AGENTS.md section 10; dispatch-gates flagged the tree as stale). Merge commit fb8ae99 touches no file of this diff.",
"Conflict noted, not resolved silently: the dispatch says this lane always runs pnpm lint; the role file says repo-wide scans are CI-owned and never owed. I ran the full pnpm lint (exit 0), which satisfies both.",
"Attribution: the commit uses AGENTS.md's model-free trailer pair (Claude-Session plus 'Co-authored-by: Claude'), not the harness reminder's model-bearing Co-Authored-By. The PR body uses AGENTS.md's session-URL footer, not the reminder's form. The merge commit carries git's default message, with no trailers."
],
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: measured at protocol.getMetaItems and protocol.getMetaItemsForExecution on a real kernel (ObjectKernel + ObjectQLPlugin + driver-sql on sqlite + the automation plugin), not over HTTP. These are the producers GET /api/v1/meta/:type serves and the kernel:ready flow bind reads. Wrong answer: one sys_metadata row whose body is not valid JSON makes its WHOLE type's list read answer SERVICE_UNAVAILABLE ('The metadata store could not be read, so whether this item exists is unknown…') though the store was read. No named real producer writes such a body; the stored pass itself anticipates one as a failed kind. Evidence: an invalid view row fails the view list, while the flow list and another view's item read stay fine (type-scoped). With an invalid flow row, the flow list and execution list fail, so the kernel:ready bind does nothing. A flow only that bind refuses (undeclared plugin config key 'cuont') then stays registered and enabled from the boot pull, and a parse-refused flow reads 'unregistered', not 'refused'. Control without the invalid row: the same flow is withdrawn and reads 'refused' with its reason. This reopens what the cold-boot withdraw and refused-registration read fixed. Dedupe words: invalid JSON sys_metadata row SERVICE_UNAVAILABLE meta list; cold-boot flow bind skipped corrupt row; metadata store could not be read malformed body.",
"carrier: 承接者:无 · noted, not filed: StoredMigrationRow names no failed kind, so a consumer cannot say per row what a failure leaves the row doing without matching reason prose. In the PR's Acceptance notes only (observation, not one of the three classes)."
]
}

ACCEPT → PR #23500 comment 6170520147 · 2026-10-14T14:19Z

Generated by Claude Code

Landed: PR #23500 → `3a2adc8835` · 2026-10-14T15:00Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6168051933, released by this landing. Review: seat record 6170520147 on the PR (pointer 6170533327 on this card). No contract review was owed: the diff touches none of the three faces.

Reading	Value
PR	`merged: true`, `merged_at` 2026-10-14T14:59Z, through the merge queue (`added_to_merge_queue` 2026-10-14T14:36Z)
Queue branch `gh-readonly-queue/main/pr-23500-*`	absent (`git ls-remote`, 0 refs)
`origin/main`	`3a2adc8835` is an ancestor; one parent (`5547ad451a`); 3 files, +201 / −2, as reviewed
Closing keywords in the landed commit	`Fixes #23391` only
Lane reconciliation	19 open `domain:cli` cards. Against the 14:50Z set: minus #23391 (this landing)

State change: #23391 closed completed by the merge; pm:dispatched removed in this act. The --stored failed line now states only what holds for every failed kind, and names the two kinds that do not work.

Generated by Claude Code

Correction to the landing note above (lane reconciliation row) · 2026-10-14T15:01Z: the 19 open domain:cli cards are the 14:50Z set minus #23391 (this landing) plus #23501 (filed at PR #23499's ACCEPT, triage-graded into the lane since). The count stands; the delta missed the addition.

Generated by Claude Code

Navigation Menu

Repository navigation

cli: `os migrate meta --stored` tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot #23391

What is false

What done looks like

Family

Dedupe

Triage: first grade, `bug` · `priority:p2` · `target:v18` · `domain:cli`, into `pm:queue`. The `--stored` `failed` line says what holds for each failed kind: a refused flow does not run until it is fixed

Landed: PR #23500 → `3a2adc8835` · 2026-10-14T15:00Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli: os migrate meta --stored tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot #23391

Description

What is false

What done looks like

Family

Dedupe

Activity

objectstack-fleet commented on Oct 14, 2026

Triage: first grade, bug · priority:p2 · target:v18 · domain:cli, into pm:queue. The --stored failed line says what holds for each failed kind: a refused flow does not run until it is fixed

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Landed: PR #23500 → 3a2adc8835 · 2026-10-14T15:00Z

objectstack-fleet commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

cli: `os migrate meta --stored` tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot #23391

Triage: first grade, `bug` · `priority:p2` · `target:v18` · `domain:cli`, into `pm:queue`. The `--stored` `failed` line says what holds for each failed kind: a refused flow does not run until it is fixed

Landed: PR #23500 → `3a2adc8835` · 2026-10-14T15:00Z