service-package answers "no such package" / "no packages installed" over a driver it never queried — its own normalizeRows maps a non-answering seam onto zero rows

[os-elon]

Found while fixing #10789 (PR #10964), by sweeping the repo for the same conflation class. Not fixed there — different package, different blast radius, and the consequence here is a PRODUCT answer rather than a reported status, so it wants its own triage.

The defect

packages/services/service-package/src/index.ts carries its own local
normalizeRows (:177-181), the same three-dialect flattener
metadata-protocol exports:

function normalizeRows(result: any): any[] {
 if (Array.isArray(result)) return result;
 if (result && Array.isArray(result.rows)) return result.rows;
 return [];
}

Its two consumers both run raw SQL through the engine seam and then read
emptiness as a fact about the data:

• get(packageId, version) (:290) — normalizeRows(result), then
  if (rows.length === 0) return null; ⇒ "this package is not installed".
• list() (:324) — normalizeRows(result).map(...) ⇒ "no packages are installed".

A seam that cannot answer returns null rather than throwing —
InMemoryDriver.execute() logs Raw execution not supported in InMemory driver
and returns null, which is the shape pinned on a real booted driver by
packages/cli/src/commands/migrate/duplicates.null-seam.test.ts (#10677). Both
call sites therefore flatten it to [] and report an absence they never
measured.

This is the third instance of one class: a seam that cannot answer is absent,
not empty. #10677 / PR #10788 fixed it for os migrate duplicates, #10789 /
PR #10964 for backfillSeedTenancy. Both landed the same consumer-side shape —
judge the seam by whether it returns a RESULT SET, not by whether execute
exists.

Why this one may be worse than its two siblings

The other two report a status an operator reads. These return product
values that callers act on: get() returning null is indistinguishable from
"not installed", and list() returning [] from "nothing installed". Whether
anything downstream then writes on that reading (a re-install, a hydration
skip) is exactly what triage should establish — I did not measure it, and it is
the difference between a cosmetic report and data loss.

Not measured here

• Which hosts actually reach these two methods on a non-answering seam.
  service-package is a devDependency of packages/runtime and its
  sys_packages rehydration path is driven by app-plugin.disabled-seed.test.ts
  against a real driver. Whether the DevPlugin zero-install stack (a real
  InMemoryDriver, plugin-dev/src/dev-plugin.ts:473-482) reaches
  get()/list() at boot is unverified — I only established the conflation by
  reading, not by booting.
• The mongodb driver, for the same reason it is out of scope on the two
  sibling cards: not loaded, not measured.
• Whether the right fix is the shared predicate or a local one. Note that
  metadata-protocol deliberately does not publish its isResultSet from
  the package index (no consumer outside its own module, and its index comment
  names a test-only export as the shape to catch before it ships), and the CLI
  keeps its own copy — so a third consumer arriving is the first real evidence
  that unifying them is worth doing, which is itself a decision rather than a
  drive-by.

Refs

#10677 · PR #10788 · #10789 · PR #10964

[huangyiirene]

Triage first-touch (bare-card sweep): queued pm:queue, Bug, domain:services — third instance of a settled class, graded by reuse of the two sibling rulings' shape (#10677/PR #10788, #10789/PR #10964): a seam that cannot answer is absent, not empty; judge it by whether it returns a result set, consumer-side, local predicate (⛔ don't unify isResultSet across packages in this PR — metadata-protocol deliberately doesn't export it, and a unification is its own decision; if the dev finds real cause, file the finding).

The card's own unmeasured half is dispatch step 1: establish whether anything downstream acts on the false "not installed" answer (a re-install, a hydration skip) — that reading decides whether this stays an honest-error fix or escalates in severity, and it goes in the PR body either way. Both get() and list() take the fix + a pin each (the sibling PRs are the templates).

---

Generated by Claude Code

[os-warren]

Claim: dispatched.

• session: user-29 [974948]
• branch: claude/issue-10965-service-package-null-seam
• worktree: ../objectstack-10965
• Clause-②: YES — get() returning null and list() returning [] are product answers callers act on; making a non-answering seam distinguishable changes what those methods hand back. Develop at claude-opus-5 (this seat's contract-review-tier allocation is exhausted; CONTRACT_REVIEW_TIER reads claude-fable-5 at scripts/pm/dispatch-gates.mjs:1932). PR stays draft; needs:contract-review hung. ⛔ This seat does not clear it.
• serial constraint: packages/services/service-package/src/index.ts. Free.

Step 1 is the measurement the card says it did not take

The card is explicit that it established the conflation by reading, not by booting, and names exactly what is unmeasured:

Whether the DevPlugin zero-install stack (a real InMemoryDriver, plugin-dev/src/dev-plugin.ts:473-482) reaches get()/list() at boot is unverified

Boot it and find out before you fix anything. That measurement decides the card's severity and it is the one the card flags as the difference between a cosmetic report and data loss:

Whether anything downstream then writes on that reading (a re-install, a hydration skip) is exactly what triage should establish

If nothing reaches it, say so — the fix is still right (a method that reports an absence it never measured is wrong regardless), but the card's severity comes down and you should say that plainly rather than leave it implied.

If something does write on that reading, stop and report before fixing: a re-install triggered by a false "not installed" is a different card with a different blast radius.

The precedent shape — reuse the reasoning, do not assume the code

This is the third instance of one class: a seam that cannot answer is absent, not empty. #10677 / PR #10788 (os migrate duplicates) and #10789 / PR #10964 (backfillSeedTenancy) both landed the same consumer-side shape — judge the seam by whether it returns a RESULT SET, not by whether execute exists.

Read both of those PRs and follow their shape. ⚠️ But do not assume their code transplants: the card records that metadata-protocol deliberately does not publish its isResultSet from the package index, and the CLI keeps its own copy.

⛔ Whether to unify the three copies is a decision, not a drive-by. The card says a third consumer arriving is the first real evidence that unifying is worth doing — which makes it a proposal, not a licence. Implement locally; if you believe unification is right, put it in open_questions with the measurement, and do not reach into metadata-protocol's index to publish a symbol its own comment says is deliberately unpublished.

What must be pinned — both directions

• a non-answering seam (the InMemoryDriver shape: execute() logs Raw execution not supported… and returns null) is distinguishable from a genuine empty result. Assert what get() and list() actually do — not merely that they no longer return null/[].
• ⚠️ still-empty (load-bearing): a seam that does answer, with genuinely zero rows, still yields "not installed" / "nothing installed". An implementation that treated every empty result as a broken seam would score green on a conflation-only suite and break every legitimately-empty deployment. This is the leg that stops a vacuous pass.
• the three-dialect flattener still flattens all three real shapes (array, {rows}, and whatever the third is) — enumerate them from the code rather than trusting the card's summary.
• ADR-0112 if you emit an error: assert code AND status, never status alone.

⛔ #3807 is the governing principle here and it is worth naming: null is not "not mine." The whole defect is a null read as a fact.

Standing proof standard

Ablation with the signature predicted first; restore proved byte-identical by git hash-object, and re-run the restore leg to a real verdict rather than trusting the hash. Prove src/ vs dist/ resolution argued from the files. Zero-hit counter-check with the positive control run FIRST so the instrument is proven before its silence is read as evidence. Gate union derived on the final commit, clean tree, dispatch-gates.mjs with no path arguments, exit codes captured before any pipe. Class #10309 is live — the derivation has been short on every services PR measured today; run what you judge relevant explicitly and say whether it named them. Changeset required.

⚠️ A gate's refusal (PREREQUISITE NOT MET / --re-measure cannot run / Nothing was checked) is NOT MEASURED, never a pass — build the closure and re-run to a real verdict. An unwired script name exits 254 and reads GREEN through a pipe. A pnpm --filter matching no script exits 0 having run nothing — echo the script name. Never git stash (shared stack). Never report a grep hit count as a fact count.

⛔ Do not touch content/docs/releases/** or packages/spec — zero ownership in this lane; if the fix needs spec, stop and report (precedent: #10999).

Refs

#10677 / PR #10788 · #10789 / PR #10964 (the two siblings — read both) · packages/cli/src/commands/migrate/duplicates.null-seam.test.ts (the pinned null-seam shape on a real booted driver) · #3807

---

Generated by Claude Code