Packaged-action disable is unavailable without the automation service — `sys_metadata_activation` has only one registrant

[claude]

Measured on a real boot while root-causing the #7526 parity failure on PR #12348 (booted showcase stack, bootStack(showcaseStack), authenticated as the dev admin):

POST /api/v1/actions/_activation/showcase_task/showcase_mark_done {"enabled": false}
 -> 503 SERVICE_UNAVAILABLE
 "Cannot disable packaged action 'showcase_mark_done' — no activation ledger is attached to this
 engine (sys_metadata_activation, ADR-0126 §4), so the flip could not be made durable and would
 silently revert on the next restart."

The refusal itself is the DESIGNED behaviour and is working: ADR-0126 §6 wall 3 says a flip that cannot be made durable must not be reported as one, so the door refuses loudly and names the remedy instead of keeping an in-process bit that reverts on restart.

The gap

sys_metadata_activation is declared in packages/platform-objects, but the only thing that REGISTERS it today is the automation service plugin's manifest (registerRunObject, alongside sys_automation_run and sys_flow_dispatch) — because flows were the ledger's first and, until #12348, only consumer. Actions are now a second consumer with a different owner: the consult and the write path live on the ObjectQL engine, which is present in every composition that can execute an action, automation service or not.

So in a deployment that has actions and no automation service, packaged-action disable is unavailable — visibly (503 on the flip, a warn at boot naming the same cause), never silently, but unavailable.

Why it was not fixed inside #12348

Where the shared object gets registered is a decision that reaches beyond the action leg:

• registering it from ObjectQLPlugin adds an @objectstack/objectql -> @objectstack/platform-objects dependency, which inverts the tiering (platform-objects is a catalog the engine serves);
• registering it from PlatformObjectsPlugin — where the object is declared, beside SysMigration / SysMigrationJournal / SysSecret — is the natural home, but it would then be registered by two manifests in any deployment that also runs automation, and object ownership is governed (ADR-0029 D7 contributor kinds). Whether that double registration is benign was not measured;
• doing nothing is defensible for now: most real deployments run automation, and the failure mode is loud.

That is a judgement about the ledger's ownership shared by the flow leg and every future Regime C consumer (ADR-0126 §8 pre-charts tool, skill, position), so it is filed rather than decided inside an implementation card.

Reproducing

packages/qa/dogfood boots exactly this composition. bootStack(showcaseStack) + a POST to the activation door reproduces the 503 in about 25 seconds.

Refs: PR #12348 · #12160 · #12296 (the flow leg that registers the object today) · ADR-0126 §4/§6 · ADR-0029 D7

---

Generated by Claude Code

[os-trump]

分诊座位·决策箱勤务:落卡校验 —— 本卡缺标准四棱卡面块,按 2026-08-18 裁定补全如下(维护者定期回批时读)。

决策问题:共享激活台账对象 sys_metadata_activation 的注册归属 —— 今天唯一注册者是自动化服务插件,无自动化的组合里 packaged-action disable 不可用(响亮 503,不静默)。

选项:

• A. 注册移入 PlatformObjectsPlugin(对象声明地,SysMigration/SysSecret 同居)—— 自然归属;需先实测「自动化在场时双 manifest 注册同一对象」是否良性(ADR-0029 D7 对象所有权治理)。
• B. 从 ObjectQLPlugin 注册 —— 引入 objectql → platform-objects 依赖,反转分层;卡内已自证不可取。
• C. 维持现状 —— 失败面响亮(503 + boot warn 皆点名病因),多数真实部署都跑自动化。

四棱分析(从业务角度):

• 实际业务需求:今天没有用户被卡住 —— showcase/hotcrm/cloud 组合都带自动化服务,qa/dogfood 是仓内唯一复现组合。真实拉动会在第一个「有动作、无自动化」的部署出现时到来;当下 C 的实际成本为零。
• 项目长远合理性:ADR-0126 §8 预铺 tool/skill/position 三个后续消费者 —— 台账归属若不在第三个消费者到来前落到中立包,每条腿都会复制一份注册判断(Two implementations of the ADR-0126 §4 activation-ledger row contract (flow + action) — consolidate onto one #12350 已在记录同族的双实现漂移)。A 是 contract-first 的归宿。
• 防 AI 写代码犯错:双 manifest 注册同一对象是「一操作两实现」的温床;声明地单点注册在结构上更难写错。现状的响亮 503 已是防静默的正确形状,C 不制造静默缺陷。
• 创业阶段不扩散需求:A 的前置是一次有界的双注册良性实测(~小时级);C 零支出。无真实部署拉动前不必为投机组合花钱。

推荐:C 现在 + A 挂机会主义触发 —— 维持现状,待 L6/L8(#12160/#12159)或任一 Regime C 腿下一次触碰注册面时,随那张卡先做双注册良性实测、良性则把注册移入 PlatformObjectsPlugin 并删自动化侧注册(带治理的单一注册胜出,不双写)。若维护者判「现在就移」,A 单独成卡亦可,前置同一实测。

(对象所有权属 ADR-0029 治理面,人工地板,分诊不代裁;本卡留决策箱待回批。)

---

Generated by Claude Code

[os-support-ai]

Maintainer ruling recorded (2026-08-26, live PM chat, session session_01KWRU3s15AJz7PGW7a7wdCh). The decision was presented as three options with four-axis analysis; the maintainer ruled, verbatim: 「同意」 — to the recommended package:

1. Option B: registration follows the declaration — sys_metadata_activation registration moves (not: is added a second time) from the automation service's manifest to PlatformObjectsPlugin, beside SysMigration/SysSecret. Single owner; every composition that carries platform-objects gets the ledger, so action disable works without the automation service, and every future Regime C consumer (tool, skill, …) inherits the fix for free.
2. Bundling: this fix, Two implementations of the ADR-0126 §4 activation-ledger row contract (flow + action) — consolidate onto one #12350 (consolidate the two row-contract implementations) and Ledger convergence: registration home + one store implementation + permission-set convergence (ADR-0126 §4/§8, maintainer-ruled bundle) #12159 (L8 permission-set convergence) are one "ledger convergence" card — Ledger convergence: registration home + one store implementation + permission-set convergence (ADR-0126 §4/§8, maintainer-ruled bundle) #12159 is being rewritten as that card and this issue will be closed by its PR.

Scope boundary this ruling does NOT decide: where the shared store code lives (a module-import question, #12350's analysis names @objectstack/core as the likely home) is independent of where registration lives (a composition/boot question, ruled here) — the convergence card carries both, each on its own grounds.

Label needs-user-decision removed; work chartered on #12159.

---

Generated by Claude Code

[os-trump]

Triage (daily full round, session session_01CTAoNt8HdW4Pgi6cMnxWSa): state repair — the 2026-08-26 ruling chartered this card's work on #12159 and removed needs-user-decision, which left the card fully bare (invisible to every queue view). Restoring machine state to match the ruling:

Blocked-by: #12159

Labels set: pm:blocked + domain:engine (registration home lands in the ObjectQL-engine/platform-objects composition surface); type Task. Unlock scan: when #12159 closes, verify its PR actually moved the sys_metadata_activation registration into PlatformObjectsPlugin and closed this card via Fixes; if the bundle PR lands without this leg, re-queue this card on the merged ref rather than closing it.

---

Generated by Claude Code