marketplace install-local merges seed datasets but never registers `seed-replayer` — every organization founded after an install on a walled deployment boots EMPTY

[os-zhuang]

Found by the HotCRM single-database multi-tenant acceptance added in objectstack-ai/cloud#1350. Measured on a real objectstack serve boot of apps/objectos-ee, OS_TENANCY_POSTURE=isolated, licensed, OS_CLOUD_URL=off, with the real 342-row HotCRM artifact installed through POST /api/v1/marketplace/install-local.

What happens

1. The install succeeds: {"success":true,...,"seeded":{"mode":"inline","inserted":342,"errors":0}}. The installer's own organization gets a full copy.
2. A customer then founds an organization. The per-organization replay logs, once per organization:

WARN [org-scoping] per-org seed: datasets present but no replayer registered {"organizationId":"..."}

3. That organization holds zero rows of the app that was just installed. Every object, every dataset.

The probe is not blind: the same GET /api/v1/data/crm_account returns the full copy for the installer's organization in the same run.

Mechanism

MarketplaceInstallLocalPlugin.applySideEffects calls mergeSeedDatasetsIntoKernel, which correctly appends the package's data blocks onto the shared seed-datasets service (this is what #3453 fixed). It never calls registerSeedReplayerOnce.

Its own docblock states the assumption that then fails:

the per-org replayer (AppPlugin) replays the whole union on the next sys_organization insert

That holds only when an AppPlugin app with seed data is ALSO mounted on the kernel — registerSeedReplayerOnce lives in AppPlugin's seeder path. On a runtime whose host app declares no data of its own — which is precisely the shape a marketplace install targets, and exactly what apps/objectos-ee is (objects: [], no data) — seed-datasets is populated and seed-replayer is absent. The middleware finds datasets, finds no replayer, and does nothing.

So the merge landed and the consumer never did.

Why this matters

This is the designed distribution path for marketplace apps into a customer's own enterprise runtime. On a walled (isolated / group) deployment it means: install the app, then every customer organization created afterwards signs up to an app with no data at all. The installer's own organization is the only one that ever gets a copy, and it gets it by the install-time inline seed rather than by the replay.

Contrast, same artifact, same boot shape

The composed-artifact boot (OS_COMPOSED_ARTIFACT_URL, objectstack-ai/cloud#1347) mounts the app through createDefaultHostConfig and therefore through AppPlugin, which DOES register the replayer. On that path both tenant organizations receive their own private copy. Same runtime, same artifact, same posture — only the arrival path differs.

Suggested shape of the fix

applySideEffects should register the replayer alongside the merge, using the same registerSeedReplayerOnce helper AppPlugin uses (it is register-once, so a host that already has one is unaffected — that is what the helper is for).

Pinned

apps/objectos-ee/test/hotcrm-install-local.acceptance.ts in objectstack-ai/cloud pins the defect as measured, with the datasets present but no replayer registered line as the tripwire. When this is fixed that test goes RED and must be promoted into a full per-organization assertion, not repaired.

Related: #3453 (the merge half of this, fixed).

---

Generated by Claude Code

[os-project-manager]

Triage: pm:queue, domain:cli (anchoring rule: MarketplaceInstallLocalPlugin.applySideEffects lives in packages/cli — verified on origin/main), type Bug, target:v17 — release-board category ① (a published-surface defect a customer hits today: the designed marketplace distribution path leaves every post-install organization empty on walled deployments). Measured end-to-end on a real boot with a real artifact, with the installer-org control proving the probe live.

Dedup run: #3453 (closed) is the merge half this card explicitly builds on; no open card covers the replayer registration. Not folded into #9011 (same endpoint, different axis — that one is the anonymous-read disclosure decision, this one is a functional break).

Dispatch notes for the cli seat:

• Fix shape per the card: applySideEffects registers via the same registerSeedReplayerOnce helper AppPlugin uses (register-once semantics make the already-mounted-host case a no-op by construction). Test the no-host-data shape specifically — that is the shape the bug lives in.
• ⚠️ Cross-repo pin flip, pre-register it in the dispatch: apps/objectos-ee/test/hotcrm-install-local.acceptance.ts in cloud pins the defect (the datasets present but no replayer registered line) and goes RED when this lands. The claim comment's serial-constraints line must name it; the consuming-side follow-up card in cloud is the accepting seat's obligation at ACCEPT time (file it with Blocked-by: this card).
• Same-file check before dispatch: GET /api/v1/marketplace/install-local serves the installed-package ledger to anonymous callers — no authentication at all #9011's eventual ruling touches the same endpoint's routing — if GET /api/v1/marketplace/install-local serves the installed-package ledger to anonymous callers — no authentication at all #9011 is ruled and dispatched first, re-verify this card's surface on the merged ref (and vice versa).

Triage: this comment is from the triage seat (scheduled run) — no claim.

---

Generated by Claude Code

[claude]

Claim: PM loop round 1
Session: session_012WKSnqAaoqtW3QX7SSf1Vk
Branch: claude/issue-9070-register-seed-replayer-install-local
Worktree: objectstack-issue-9070
Domain: domain:cli
File surface: packages/cloud-connection/src/marketplace-install-local-plugin.ts (+ its sibling marketplace-install-local-*.test.ts) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — node scripts/pm/dispatch-gates.mjs --tier reports no path-derived mandate for this surface (floor sonnet / default opus / ceiling fable); clause ② judged from card content: this registers a replayer to restore declared = enforced, it does not widen the accept set or the public surface, so not fable-mandatory.
Serial constraints cleared: packages/cloud-connection is free — no other in-flight card in this lane touches it. ⚠️ Same-day churn on this exact file: 01074e5 (2026-08-17, #9256, the #9011 install-local auth narrowing) landed today; premise re-verified against it below. Sibling in flight #9120 / PR #9291 is packages/rest only — disjoint. ⚠️ Cross-repo pin flip pre-registered: apps/objectos-ee/test/hotcrm-install-local.acceptance.ts in objectstack-ai/cloud pins the defect (datasets present but no replayer registered) and is expected to go RED when this lands; the consuming-side follow-up card in cloud is this seat's obligation at ACCEPT time.

Premise re-verified on origin/main @ 68cd4e7 by the PM before dispatch (not inherited from the card): applySideEffects is at marketplace-install-local-plugin.ts:1212; step 2 calls mergeSeedDatasetsIntoKernel, step 3 seeds inline, and registerSeedReplayerOnce appears nowhere in packages/cloud-connection — it is exported from packages/runtime (seed-datasets.ts:98, re-exported at runtime/src/index.ts:70) and used only by app-plugin.ts:1029.

⚠️ One correction to the triage comment, carried so it is not re-derived wrongly: triage states the fix "lives in packages/cli — verified on origin/main". It does not. packages/cli only names the class in comments and constructs it (serve.ts:2092/2133). The fix lands in packages/cloud-connection. The lane is unchanged (cloud-connection is cli-lane ground), but the package is not the one triage named — do not go looking in packages/cli.

⭐ The step-3 comment block already states "don't rely on the seed-replayer registered by AppPlugin since (a) it isn't registered when the host runtime has no AppPlugin app with seed data". The author knew the replayer can be absent and handled only the immediate seed path; the future-organization replay path is the one still unserved. That is the defect, and it is worth reading before writing.

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 9070,
  "status": "done",
  "branch": "claude/issue-9070-register-seed-replayer-install-local",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9341",
  "premise_still_valid": true,
  "summary": "Premise re-measured on current origin/main (ceb37ba, past the 68cd4e7 dispatch ref) and confirmed: applySideEffects at marketplace-install-local-plugin.ts:1212 merged via mergeSeedDatasetsIntoKernel and registerSeedReplayerOnce appeared nowhere in packages/cloud-connection. The same-day 01074e5 auth narrowing did not move the surface. Fix: applySideEffects step 2 now calls registerSeedReplayerIntoKernel next to the merge, routing through the runtime's registerSeedReplayerOnce with the same lazy-import + typeof guard + inline fallback as the sibling merge. packages/runtime was NOT edited. Two consequences of the consumer contract, both measured rather than assumed: the replayer reads the LIVE shared list per call (union replay), and runInlineSeed now also returns the loader's raw error ARRAY (errorList) because the org-scoping consumer reads summary.errors.length and .slice(0,5) — a count reads as '0 error(s)' through its optional chaining. Placement in step 2 also covers the rehydrate path (seedNow:false), where a restarted runtime re-registers.",
  "tests": "Gate union re-run at FINAL commit fd543cee8 on a clean tree, all exit 0: check-nul-bytes | docs-audit/check-affected-docs (dispatch-named) | check-adr-0087-registration | check-changeset-no-major | check-empty-changeset | check:changeset-gate-self-tests | check:objectui-changeset | check:query-options-erasure | check:engine-double-contract | check:where-matcher | check:type-check-coverage. Gates BEYOND the dispatch list, added after re-deriving from actual changed paths via `node scripts/pm/dispatch-gates.mjs`: the five .changeset-triggered gates, and the five convention-triggered ones the new test file moves (query-options-erasure, type-check-coverage, type-check-debt, engine-double-contract, where-matcher). check:type-check-debt --re-measure refused on an unbuilt tree (that refusal is NOT MEASURED, not N/A), so the full closure was built (turbo: 70 successful) and it then ran green: '33 ledger entr(ies) re-measured in 225.4s, 1926 raw tsc error(s) total, none above its recorded number', 'surplus: none'. cloud-connection sits at exactly its frozen DEBT of 13 — this diff adds 0. Package suite: `npx vitest run --maxWorkers=2` in packages/cloud-connection -> 'Test Files 22 passed (22) / Tests 173 passed (173)'. New pin alone, verbose: 9 passed (9). REVERSE VERIFICATION, direction predicted before running (predicted 8 RED / 1 GREEN, observed exactly that): plugin restored to base via `git restore --source=HEAD~1` with the new test kept -> 'Test Files 1 failed (1) / Tests 8 failed | 1 passed (9)' — 3x AssertionError \"expected 'undefined' to be 'function'\", 4x TypeError 'replayer is not a function', 1x 'expected vi.fn() to be called 1 times, but got 0 times'. The 1 GREEN is the 'never displaces a replayer the host already registered' control, green against unfixed code BY CONSTRUCTION (unfixed code registers nothing, so the incumbent trivially survives) — reported as a control, not as a defect pin. Fix restored from the commit; tree verified clean before the union ran. Direct `tsc --noEmit -p tsconfig.json` on cloud-connection: 13 diagnostics, 0 in either file this PR touches (all in connection-credential-store.test.ts, cloud-connection-plugin.test.ts, marketplace-install-local-bundle.test.ts). NOTE on a local-verification trap: cloud-connection declares only build+test scripts, so `pnpm --filter @objectstack/cloud-connection typecheck` matches zero scripts and exits 0 — a false green; tsc was invoked directly instead.",
  "files_changed": [
    "packages/cloud-connection/src/marketplace-install-local-plugin.ts",
    "packages/cloud-connection/src/marketplace-install-local-seed-replayer.test.ts (new, 9 cases)",
    ".changeset/install-local-seed-replayer-registration.md (new)"
  ],
  "deviations": [
    "File surface honoured exactly: only the two declared paths plus the changeset. packages/runtime NOT edited; objectstack-ai/cloud NOT touched.",
    "Branched off current origin/main ceb37ba, not the dispatch ref 68cd4e7 — main had moved 3 commits. Premise re-verified against ceb37ba, not inherited.",
    "In-scope refactor inside the declared file: the inline seed-datasets read closure in mergeSeedDatasetsInline was extracted to a private readSharedSeedDatasets, because the replayer needs the same live read. Same defect class, same file, no new verification surface.",
    "runInlineSeed's return type gained an additive errorList field. Private method, same file; existing callers keep reading the count. Named here because it is the one change not literally 'register a replayer'.",
    "PROCESS INCIDENT, self-caught and fully repaired: my first changeset used an auto-style filename (lucky-pugs-repeat.md) that already existed on main, and the Write overwrote a service-analytics changeset. Caught because `git add` staged it as M rather than A. Restored with `git checkout HEAD --` and confirmed byte-identical (empty `git diff HEAD` for that path) BEFORE committing; the clobbered file is not in this PR's diff (3 changed files). Re-filed under a collision-checked name. Nothing reached the remote in the broken state."
  ],
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code