Observation-class, filed unassigned while implementing #8692 (PR #9129). Nothing here is broken; the gap is that the operator-facing text does not describe the outcome operators will actually see.
The shape
packages/cli/src/commands/meta/resync.ts (docblock, ~line 52) enumerates the rows resync leaves alone:
Business data is never touched — only sys_permission_set definition rows. A row an admin has taken over in Setup (managed_by:'user') or a package owns ('package') is an intentional override and is left alone.
It names 'user' and 'package'. It does not name 'admin', which is the value the tri-state vocabulary actually uses (sys-permission-set.object.ts describes 'user' as the legacy spelling, normalized to 'admin' by normalizeManagedByVocab).
Why it matters more after #8692
The maintainer ruling on #8692 (2026-08-15) is forward-stamp only: the seeder now stamps managed_by: 'platform' on new rows, and existing 'admin'-stamped rows are deliberately never migrated, because a stored 'admin' cannot be told apart from a genuine Setup takeover. That is the right call, and PR #9129 pins it.
The consequence for operators: on every install created before that ruling, os meta resync will report something like resynced 0 / skipped 8 — permanently, by design. The command's own documentation gives no way to understand that outcome, since the one provenance value responsible for it is the one value the docblock does not list. The reasoning now exists in bootstrap-platform-admin.ts's docblock (added by #9129), but that is a plugin internal, not what an operator running the CLI reads.
Not fixed in #9129, deliberately
That PR declares the file surface packages/plugins/plugin-security/src/**, and this file is in packages/cli. It also fails the in-place exemption on gate families — a packages/cli/** edit pulls a different set — so it is filed rather than ridden along. The sentence quoted above is incomplete, not false: 'user' and 'package' rows genuinely are intentional overrides.
Suggested shape of a fix
Add 'admin' to the enumeration and one sentence on the pre-#8692 legacy case, in the docblock and wherever the command surfaces its skip count to the operator. Whether the CLI's runtime output should also explain a nonzero skip count (rather than only the docblock) is a product call worth deciding at the same time — that is the part an operator actually sees.
Reference
Observation-class, filed unassigned while implementing #8692 (PR #9129). Nothing here is broken; the gap is that the operator-facing text does not describe the outcome operators will actually see.
The shape
packages/cli/src/commands/meta/resync.ts(docblock, ~line 52) enumerates the rows resync leaves alone:It names
'user'and'package'. It does not name'admin', which is the value the tri-state vocabulary actually uses (sys-permission-set.object.tsdescribes'user'as the legacy spelling, normalized to'admin'bynormalizeManagedByVocab).Why it matters more after #8692
The maintainer ruling on #8692 (2026-08-15) is forward-stamp only: the seeder now stamps
managed_by: 'platform'on new rows, and existing'admin'-stamped rows are deliberately never migrated, because a stored'admin'cannot be told apart from a genuine Setup takeover. That is the right call, and PR #9129 pins it.The consequence for operators: on every install created before that ruling,
os meta resyncwill report something likeresynced 0 / skipped 8— permanently, by design. The command's own documentation gives no way to understand that outcome, since the one provenance value responsible for it is the one value the docblock does not list. The reasoning now exists inbootstrap-platform-admin.ts's docblock (added by #9129), but that is a plugin internal, not what an operator running the CLI reads.Not fixed in #9129, deliberately
That PR declares the file surface
packages/plugins/plugin-security/src/**, and this file is inpackages/cli. It also fails the in-place exemption on gate families — apackages/cli/**edit pulls a different set — so it is filed rather than ridden along. The sentence quoted above is incomplete, not false:'user'and'package'rows genuinely are intentional overrides.Suggested shape of a fix
Add
'admin'to the enumeration and one sentence on the pre-#8692 legacy case, in the docblock and wherever the command surfaces its skip count to the operator. Whether the CLI's runtime output should also explain a nonzero skip count (rather than only the docblock) is a product call worth deciding at the same time — that is the part an operator actually sees.Reference
packages/cli/src/commands/meta/resync.ts(docblock, ~line 52)packages/plugins/plugin-security/src/bootstrap-platform-admin.ts(the seeder docblock fix(security): platform default permission sets are stampedmanaged_by: 'platform'soos meta resyncreconciles them (#8692) #9129 added, which carries the reasoning)os meta resyncmay silently skip every platform default permission set — the seeder never writesmanaged_by, and the tests stub the field default away #8692 / PR fix(security): platform default permission sets are stampedmanaged_by: 'platform'soos meta resyncreconciles them (#8692) #9129