plugin-security: claimSeedOwnership runs once, at admin promotion, and races the platform's own background seeder — every object seeded after its pass is ownerless forever

What happens

claimSeedOwnership (plugin-security) is reached from bootstrapPlatformAdmin exactly once per database lifetime — on the single pass that promotes the first admin. It then walks the object registry once, in registry order, while the platform's own seeder is still writing rows in the background. Every object whose claim pass happens before its seed rows land stays owner_id IS NULL forever: nothing ever re-runs the claim.

Registry order and seed order are unrelated, so which objects lose the race is arbitrary — but it is deterministic per app, and it reproduces identically boot after boot.

The two halves that combine

The claim is one-shot. Later replays short-circuit before ever reaching it:
- runBootstrap is hooked on kernel:ready, and replayed by a middleware only for sys_user / sys_account insert (shouldReplayBootstrapFor).
- bootstrapPlatformAdmin returns { adminPromoted: false, reason: "already_have_admin" } as soon as an unscoped human holder of the admin permission set exists — which is true on every pass after the first. claimSeedOwnership is called after the grant insert, so a short-circuited pass never reaches it.
The seeder outlives that instant, by the platform's own design. An app whose inline seed exceeds the 8000 ms budget is continued in the background:

WARN [Seeder] Inline seed exceeded 8000ms budget for APP_ID; continuing in background to avoid blocking kernel start.

So for any non-trivial app, seeding is guaranteed to still be running when the one-shot claim walks the registry.

Reproduction — `@objectstack/* 17.4.0`, HotCRM, `objectstack dev`, fresh DB

(Timings below are from the first boot. The second, independent boot used objectstack serve --dev on a fresh DB and produced the identical loser set.)

The dev admin is created at 04:21:12.578 and promoted at 04:21:12.655; the claim walks from there. The seeder runs until 04:21:50.8.

The claim's own passes are readable in updated_at (one bulk write per object, so MIN(updated_at) == MAX(updated_at) on an untouched table):

object	seed rows written	claim pass reached it	outcome
`crm_account`	04:21:03–04	04:21:13.1	claimed, 9/9
`crm_lead`	04:21:09–15.0	04:21:18.4	claimed, 21/21
`crm_contract`	04:21:20.7–23.1	(already passed)	4 rows unowned
`crm_campaign_member`	04:21:23.9–29.1	(already passed)	51 rows unowned
`crm_opportunity_line_item`	04:21:15.3–19.9	04:21:32.7	claimed, 74/74
`crm_case`	04:21:35.2–45.0	(already passed)	38 rows unowned
`crm_product`	04:21:04–05	04:21:36.1	claimed, 13/13
`crm_quote`	04:21:23.2–23.8	04:21:36.3	claimed, 6/6
`crm_task`	04:21:31.6–32.7	04:21:39.0	claimed, 7/7
`crm_event`	04:21:45.4–49.6	(already passed)	27 rows unowned
`crm_event_attendee`	04:21:49.8–49.9	(already passed)	27 rows unowned
`crm_knowledge_article`	04:21:50.0–50.4	(already passed)	4 rows unowned

Every row of the rule holds: an object is claimed iff its seed rows had landed when the walk reached it. The registry order here is the app's alphabetical barrel order, and the loser set is contiguous in it.

Second, independent boot of the same tree reproduced the identical loser set — crm_case 38, crm_campaign_member 51, crm_contract 4, crm_event 27, crm_event_attendee 27, crm_knowledge_article 4. Not flaky; deterministic.

No warning is logged. claimSeedOwnership's own failure paths (claimSeedOwnership failed for OBJECT, the paging and affected-count warnings) never fire, because from the claim's point of view there was simply nothing to match yet. The boot banner is clean and every later boot reports healthy.

Why it matters

Rows that miss the claim are ownerless permanently. Under sharingModel: 'private' they are invisible to every readScope: 'own' grant; under public_read they read fine and answer 403 on every write for any grant at modifyAllRecords: false — a granted permission that can never be exercised. Nothing in the product says so.

An app can only work around this with a recurring sweep, because the completion of a background seed is not an event app metadata can observe. That is the state HotCRM is in today: a */10 * * * * flow, measured in one production tenant at 1,776 runs in 13 days (objectstack-ai/hotcrm#1892), whose only real job is to finish the claim the platform abandoned. It cannot be made one-shot or self-disabling while this defect stands — verified by ablation: with that sweep's cron disabled on an otherwise identical boot, the 73 rows above were still ownerless 21 minutes later, while two other scheduled flows fired normally in the same boot.

Suggested direction (not a ruling)

Either re-run the claim when the background seed completes, or defer the first claim until then. A "claim on admin promotion" that races a seeder the platform itself deferred cannot be correct as a single pass.

Related: objectstack-ai/hotcrm#1892 (the app-side card this blocks) · #14719 and #14530 (other claimSeedOwnership limits, both closed, neither this ordering) · #14157 (the neighbouring maybeSeedDevAdmin / kernel:ready ordering bug).

Measured and filed by Claude Code (session session_0132iDHq4FLW2zS9VPXqbf9f) while working objectstack-ai/hotcrm#1892.

Generated by Claude Code

Claim: PM loop round 1
Session: session_01URLHobLUJB9K1ABV6ofdjj
Branch: claude/issue-17628-claim-seed-ownership-race
Worktree: objectstack-issue-17628
Domain: domain:services
File surface: packages/plugins/plugin-security/src/** (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgement tier — this run's dispatch-gates --tier on this card's paths returned "no path-derived mandate … floor sonnet · default opus · ceiling fable", so the tier is this seat's per-card call
Clause-②: yes
Thread-read: 5642704734
Serial constraints cleared: Scanned ALL 21 open claude/* PR branches this run (git diff --name-only against each merge-base), positive control: PR #17718 returned its 8 files. ZERO open branch touches packages/plugins/plugin-security/** ⇒ clear. ⚠️ ONE fence to carry: draft PR #17718 (card #17178, another lane) holds packages/metadata-protocol/src/seed-loader.ts and packages/runtime/src/app-plugin.ts — the two files a seed-completion signal would most plausibly originate in. Neither is a SINGLE_CLAIM_PATHS member (that set has exactly one member, .objectui-sha), so this is ORDINARY concurrency, ⛔ not a serial lock: if the repair must reach them, merge main first and the later lander resolves. ⛔ No in-flight sibling in this lane — 0 in flight at seating.

⚠️ Correction, 2026-09-12T16:04Z — Clause-② above was changed from no to yes IN PLACE by the seat that wrote it.

My original no rested on the reading that restoring ownership of rows the one-shot pass missed neither widens an accept set nor adds a published symbol. The first half still holds; the second half was never measured, and it is wrong. The delivered shape adds NEW KEYS ON A PUBLISHED PAYLOAD, which the tree-readable rule makes an unconditional yes: bootstrapPlatformAdmin (exported at packages/plugins/plugin-security/src/index.ts:33) gains adminUserId?: string on its return object, and bootstrapPlatformAdmin plus claimSeedOwnership (index.ts:78) each gain an optional seedSettlement key on their options bag. Verified by the seat on the PR diff, ⛔ not taken from the report: the added lines are in bootstrap-platform-admin.ts and claim-seed-ownership.ts, and both symbols are re-exported from the package's . entry.

⚠️ The mechanical floor is silent here, so it is no defence: check-widening-tells --declaration no answers NOT MEASURED on all six files because no declared surface covers packages/plugins/**. A gate that cannot see a surface ⛔ never converts into a clean reading — the rule decides, not the gate's silence.

The dev found this and reported it instead of editing it, which is exactly right — the declaration is the seat's carrier, the PR body is the dev's. Corrected here, in the place the gate reads, ⛔ not in a second comment. needs:contract-review hung on this card in the same stroke.
_{domain:services execution seat · seat post #6021 · seated 2026-09-12T15:09Z}

Generated by Claude Code

os-dev-report

{
  "issue": 17628,
  "status": "done",
  "branch": "claude/issue-17628-claim-seed-ownership-race",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17872",
  "premise_still_valid": true,
  "summary": "Premise re-verified on origin/main at c88fa2ccd: claimSeedOwnership had exactly one call site (bootstrap-platform-admin.ts, inside promote()), unreachable after the already_have_admin short-circuit, and plugin-security had zero app:seeded subscribers. Fix: security-plugin.ts re-runs claimSeedOwnership on app:seeded against the admin bootstrapPlatformAdmin now reports (adminUserId, on the promotion path and on the already_have_admin short-circuit), with the one-shot pass's own predicates and target unchanged. Detector: every claim pass now emits one line and states whether its reading was final, read through the published seed-settlement contract (provisional=warn / final=info / unattested=info). File surface held: packages/plugins/plugin-security/src/** only, plus one changeset and one gate-ledger regeneration. PM Zone-2 fence 3 not reached: no merge of main was needed, seed-loader.ts and app-plugin.ts untouched.",
  "files_changed": [
    "packages/plugins/plugin-security/src/security-plugin.ts (+100)",
    "packages/plugins/plugin-security/src/claim-seed-ownership.ts (+146/-13 incl. doc)",
    "packages/plugins/plugin-security/src/bootstrap-platform-admin.ts (+48)",
    "packages/plugins/plugin-security/src/claim-seed-ownership-seed-settle-rerun.test.ts (+402, new)",
    ".changeset/great-pugs-attack.md (+13, new, minor)",
    "scripts/engine-double-contract.pinned.json (+10, regenerated by --write)"
  ],
  "tests": "pnpm --filter @objectstack/plugin-security test => 111 files / 2148 tests passed. pnpm --filter @objectstack/plugin-security typecheck => exit 0 (tsc --noEmit + scripts project + check:test-typecheck OK, 0 files / 0 errors / 0 pinned signatures). pnpm --filter '@objectstack/plugin-security^...' build => exit 0. Import side: plugin-auth human-user-predicate-agreement.pin.test.ts (calls bootstrapPlatformAdmin) => 22 passed; the only other external call site, packages/cli/src/commands/meta/resync.ts, is unchanged (new option optional, not passed). pnpm lint (eslint . --no-inline-config, WHOLE REPO, not a narrowed slice) => exit 0 at 569520bd. ABLATION 1 (remove the app:seeded re-run wiring): mutation proven on disk (anchor 1 -> deleted 0 / injected 1; HEAD blob 70f04ed0f93fccb9f1a5f0267c77f47ce5cfdb43 vs on-disk 69fa4314adf474e8904a74de30b29a54c2265ea8) => 3 failed | 7 passed; restored under trap, git diff HEAD empty, blob back to 70f04ed0. ABLATION 2 (restore the pre-fix 'if (results.length > 0)' silence): call sites 1 -> 0, pre-fix guard 0 -> 1; HEAD blob 6d34e418a506fdee4a514398ae543145d4aaf21a vs on-disk 637091d2df8b36fd6c200d13c15d2ce388c4e5d9 => 6 failed | 4 passed; restored, blob back to 6d34e418. Ablation 1's FIRST attempt was a no-op measurement (dropping async made the file unparseable, vitest transform error, zero assertions ran); it was corrected and re-run, and only the second reading is reported. No ablation artefact remains: git status clean.",
  "gates": {
    "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, re-derived after the diff settled (change set grew to 6 paths when the engine-double ledger landed); reconciled with --ran",
    "reconciliation": "70 derived, 67 run, 3 NOT-MEASURED, 0 UNRUN (exit 0)",
    "run_all_green": true,
    "not_measured": [
      "pnpm check:dual-build-cjs-loads - exit 3 PREREQUISITE NOT MET (reads built dist for 53 packages; needs a full pnpm build)",
      "pnpm check:i18n - exit 3 PREREQUISITE NOT MET (needs the extract-config build closure)",
      "pnpm check:type-check-debt - exit 3 PREREQUISITE NOT MET (15 workspace deps have no built type entry point; re-measuring here would measure a different world)"
    ],
    "findings_fixed_in_this_pr": [
      "pnpm check:engine-double-contract - the new test double's findOne did not route through assertEngineFindOnePredicate (fixed) and its update double was absent from the pinned ledger (regenerated with --write); gate now exit 0"
    ],
    "outside_the_derived_total": "50 artifact-roster families, 11 declared-wide families, 5 path-scheduled CI jobs (27 steps) and the always-runs tail are outside the 70 and are CI's."
  },
  "line_budget": "n/a - 0 paths under skills/** in the diff",
  "mcp_calls": "0 - card body, comments, PR creation, PR read-back and the report comment all went through repo-scoped REST (probe returned 200); git for everything else",
  "deviations": [
    "CLAUSE-2 DECLARATION IS WRONG FOR THIS SHAPE - PM ACTION. The claim comment reads 'Clause-2: no'. This diff adds NEW KEYS ON A PUBLISHED PAYLOAD, which the tree-readable rule makes an unconditional 'yes': bootstrapPlatformAdmin (index.ts line 33) gains adminUserId?: string on its RETURN object, and bootstrapPlatformAdmin + claimSeedOwnership (index.ts line 78) each gain an optional seedSettlement key on their options bag. All additive; nothing existing changed shape. The changeset is already 'minor' accordingly. The mechanical half is a FALSE NEGATIVE and was measured as one: scripts/pm/check-widening-tells.mjs --declaration no answers NOT MEASURED on all 6 files (no declared surface covers packages/plugins/**), and scripts/pm/check-clause2-carriers.mjs --pair 17872 therefore exits 0. needs:contract-review was NOT hung, per the dispatch's instruction that the PM corrects the claim carrier.",
    "Three gates are NOT MEASURED locally on a PREREQUISITE NOT MET (exit 3), not on a finding - see gates.not_measured. Declared rather than cleared: clearing them needs a full monorepo build, which CI performs."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the org-scoping twin claimOrgSeedOwnership (@objectstack/organizations) is injected into ensureDefaultOrganization as a one-shot handoff at the org bind - structurally the same 'claim once at a bootstrap instant'. NOT covered by this repair and NOT the same mechanism (app:seeded is single-tenant only; multi-tenant seeds are suppressed at boot and replayed per org on sys_organization insert). Nothing reproduced there, so no repro exists to file on. Successor: whoever next touches packages/plugins/organizations/src/claim-org-seed-ownership.ts or the per-org seed replay.",
    "noted, not filed: the sweep's window is wider than the promotion instant by design - app:seeded can fire after kernel:listening on an over-budget boot, so the claim can run while HTTP is open. The rows it can move are unchanged (unowned only). Recorded in the PR's acceptance notes as a bounded, stated consequence. Successor: this PR's reviewer."
  ]
}

Generated by Claude Code

os-dev-report

{
  "issue": 17628,
  "status": "done",
  "step": "main-sync + ledger regeneration (landing step, not rework)",
  "branch": "claude/issue-17628-claim-seed-ownership-race",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17872",
  "new_head_sha": "ff939866eb2b4ba0ec6fb0a0b7155a75d94697d4",
  "new_head_short": "ff939866e",
  "merge_commit_parents": "ff939866e = 569520bdb (branch) + e7fea4665 (origin/main) - a real merge commit; no rebase, no amend, push was a fast-forward 569520bdb..ff939866e",
  "premise_still_valid": true,
  "two_entry_ledger_assertion": {
    "verdict": "BOTH PRESENT - the silent-drop trap did NOT fire",
    "mine_17628": "packages/plugins/plugin-security/src/claim-seed-ownership-seed-settle-rerun.test.ts - 2 rows (findOne, update)",
    "sibling_17871": "packages/services/service-messaging/src/notification-delivery-retention-sweep.test.ts - 1 row; origin/main also carries exactly 1, so the count matches main's",
    "total_rows": "791 (790 on my pre-merge branch + 1 from main)",
    "proved_by_regeneration_not_by_reading_the_merge": "node scripts/check-engine-double-contract.mjs --write on the merged tree reported '791 row(s), 0 added or grown, 0 lost' and produced a file BYTE-IDENTICAL to the merged bytes (diff -q clean). A real regeneration agreeing with the merge is the evidence; the merge exiting 0 is not.",
    "implementation_body_survived": "git rev-parse blob equality against origin/main: notification-delivery-retention-sweep.test.ts (13033 bytes) identical=yes; objects/notification-delivery.object.ts (9412 bytes) identical=yes; .changeset/17611-terminal-delivery-retention.md (3345 bytes) identical=yes",
    "strongest_check": "git diff origin/main HEAD --name-status lists ONLY my 6 paths (1 A + 3 M in plugin-security, 1 A changeset, 1 M ledger). Nothing of main's appears as a deletion or reversal, which is what a swallowed side would look like.",
    "hand_edit": "none - the ledger was only ever written by check-engine-double-contract.mjs --write"
  },
  "os_regen_merge_script": {
    "command": "bash scripts/pm/os-regen-merge.sh",
    "exit": 0,
    "steps_1_to_3": "merge origin/main (ort, auto-merged scripts/engine-double-contract.pinned.json), per-file side selection over the 18 os-regen patterns, merge committed FIRST. Step 3 reported 'merge left no additional changes to commit'.",
    "deferral": "no $GIT_DIR/os-regen-pending file was written, so nothing was owed to a following commit and the pre-push hook passed",
    "step_4_run_not_skipped": "spec build closure -> pnpm --filter @objectstack/spec check:generated => exit 0, all 15 generated artifacts up to date (nothing stale, so no regeneration commit exists); engine-double ledger regenerated with --write => byte-identical; quoted-exact-name assertions run; staged diff inspected (there was none - git status clean)",
    "gen_schema_in_merge_state": "never run - the merge was committed before any regeneration, exactly as the header's ordering trap requires"
  },
  "gates_post_merge": {
    "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack re-derived at ff939866e; merge base is now e7fea4665 (= origin/main tip), change set 6 paths, no 'behind origin/main' warning",
    "reconciliation": "70 derived, 67 run, 3 NOT-MEASURED, 0 UNRUN (dispatch-gates --ran exit 0)",
    "run_all_green": true,
    "exit_code_capture": "every gate ran as ( eval cmd ) > logfile 2>&1 with $? read on the next line - no pipe between the gate and the status read",
    "not_measured": [
      "pnpm check:dual-build-cjs-loads - exit 3, log contains PREREQUISITE NOT MET",
      "pnpm check:i18n - exit 3, log contains PREREQUISITE NOT MET",
      "pnpm check:type-check-debt - exit 3, log contains PREREQUISITE NOT MET"
    ],
    "delta_vs_pre_merge_run": "same 70 families, same 3 NOT MEASURED; check:engine-double-contract now exit 0 on the first try (pre-merge it was the one finding, fixed then). Two families that main's own PRs added are now in my derived list and green: check-registry-log-declared.mjs and its --self-test."
  },
  "post_merge_reverification": {
    "spec_moved_on_mains_side": "yes - liveness/state-counts.md, dashboard.json, undrilled-containers.baseline.json. AGENTS.md multi-agent discipline section 10 overlap rule honoured: pnpm --filter @objectstack/spec build then check:generated => exit 0 / 15 up to date.",
    "install": "pnpm install --frozen-lockfile => exit 0; packages/runtime/.objectstack removed",
    "dependency_closure": "pnpm --filter '@objectstack/plugin-security^...' build --concurrency=2 => exit 0",
    "tests": "pnpm --filter @objectstack/plugin-security test => 111 files / 2148 tests passed (unchanged from pre-merge)",
    "typecheck": "pnpm --filter @objectstack/plugin-security typecheck => exit 0 (tsc --noEmit + scripts project + check:test-typecheck OK, 0 files / 0 errors / 0 pinned signatures)",
    "lint": "pnpm lint (eslint . --no-inline-config, whole repo, on the merged tree that now carries main's new rest/, driver-sql/, service-messaging/ and scripts/ sources) => exit 0"
  },
  "sibling_merge_independently_verified": "origin/main advanced c88fa2ccd -> e7fea4665. Non-shallow checkout (git rev-parse --is-shallow-repository = false, 13758 commits). Ancestry legs both ways: e7fea4665 and c88fa2ccd are each ancestors of origin/main (exit 0, the positive controls at full depth); origin/main was NOT an ancestor of my pre-merge HEAD (exit 1), which is the reading that needed the depth. #17871's test file present on origin/main by git cat-file -e.",
  "carriers_untouched": "PR is still draft=true; labels unchanged and still carry needs:contract-review (read back from the API after the push, alongside documentation/size~l/tests/tooling). I flipped nothing and cleared nothing - both carriers are the seat's.",
  "mcp_calls": "0 - repo-scoped REST for the PR read-back and this comment; git for everything else",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

fix(plugin-security): re-run the seed-ownership claim when the backgr…

Navigation Menu

Repository navigation

plugin-security: `claimSeedOwnership` runs once, at admin promotion, and races the platform's own background seeder — every object seeded after its pass is ownerless forever #17628

What happens

The two halves that combine

Reproduction — `@objectstack/* 17.4.0`, HotCRM, `objectstack dev`, fresh DB

Why it matters

Suggested direction (not a ruling)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-security: claimSeedOwnership runs once, at admin promotion, and races the platform's own background seeder — every object seeded after its pass is ownerless forever #17628

Description

What happens

The two halves that combine

Reproduction — @objectstack/* 17.4.0, HotCRM, objectstack dev, fresh DB

Why it matters

Suggested direction (not a ruling)

Activity

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

claude commented on Sep 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

plugin-security: `claimSeedOwnership` runs once, at admin promotion, and races the platform's own background seeder — every object seeded after its pass is ownerless forever #17628

Reproduction — `@objectstack/* 17.4.0`, HotCRM, `objectstack dev`, fresh DB