Repair three durability swallows in metadata-protocol and service-storage — batch 7 of the #12981 worklist

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,

.changeset/durability-swallow-batch-7.md

@@ -0,0 +1,58 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-storage': minor
+---
+
+Report the refused writes three `catch { }` sites swallowed (#12981 batch 7)
+
+Three tier-1 DARK sites from the #12981 swallow-family worklist, across two
+packages. Control flow is unchanged at every one of them — none of these
+failures should abort the operation it sits inside — but none of them is silent
+any more.
+
+**`metadata-protocol` — `reassignOrphanedMetadata` (the durability one).**
+ADR-0070 D5's orphan-adoption loop dropped a refused `sys_metadata` update
+whole: not logged, not rethrown, not carried on the response. The return line
+reports `success: reassigned.length > 0`, so an adoption in which 99 of 100
+orphans were refused answered `{ success: true, reassignedCount: 1 }` — a
+response identical in shape to a healthy run with one orphan to move — while
+the 99 stayed orphans, with nothing retrying them and no record that they had
+been tried. The loop now counts refusals and states the degradation **once**
+after the loop at `console.error`, naming the count, the target package, the
+driver's own sentence and the fix. `error` and not this file's usual
+`console.warn`, by the AGENTS.md question this turns on: the system keeps
+looking normal while something it claims to have persisted did not land. It is
+the verdict `recordPackageCommit` in the same file already reaches on the same
+sink, and the inverse of the one `clientFacingRowFailureText` records for its
+`console.warn` (there the row reports `success: false` and the counters
+reconcile; here neither holds). The response shape is untouched — no
+`failedCount` was added.
+
+**`service-storage` — two sites at the tail of `StorageServicePlugin.start()`,
+both functional, both `warn`.**
+
+- The settings-namespace binding ended in `catch { }` with a comment naming
+ only one of the two outcomes it caught. The settings service being **absent**
+ (a bare kernel, where nothing ever claimed the admin UI could swap adapters)
+ is now resolved on its own line and stays correctly silent; a binding that
+ **fails with the service present** is reported, because `start()` otherwise
+ completes into a healthy-looking boot whose storage settings screen is wired
+ to nothing — an operator's adapter or credential change is saved and never
+ applied.
+- The `storage/test` probe cleanup swallowed its own failure in
+ `catch { /* ignore */ }`. The result returned beside it reports the *probe's*
+ failure, which is a different failure: one stray `__objectstack_probe__/…`
+ key accrued per failed test and the only record of its name died with the
+ frame. The refused cleanup now names the key it left behind.
+
+Both `service-storage` sites are `warn` on the merits, not by default: neither
+is a durability degradation. Storage keeps serving from the adapter the
+plugin's own options built, and the leaked probe object is inert content no
+record references — AGENTS.md is explicit that escalating these is what makes
+`error` unreadable. No sink type is changed at any of the three sites: the two
+`service-storage` reports go to `PluginContext.logger`, whose `error` is
+already non-optional, and `metadata-protocol` reports on `console`.
+
+Each repaired seam is pinned by a test that fails if it goes quiet again, plus
+absence-asserting controls — declared as controls — so a seam that reports
+unconditionally cannot pass.

packages/metadata-protocol/src/protocol.reassign-orphans-durability.test.ts

@@ -0,0 +1,247 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#12981 batch 7] A refused orphan rebind in `reassignOrphanedMetadata` must
+ * not be silent.
+ *
+ * ADR-0070 D5's adoption loop walked every package-less `sys_metadata` row and
+ * rebound it to a target base. Its `catch` was bare:
+ *
+ * } catch {
+ * /* skip a row that fails to update; report only what moved *\/
+ * }
+ *
+ * and the return line below it reports `success: reassigned.length > 0`. Put
+ * together, an adoption in which 99 of 100 orphans were REFUSED answered
+ * `{ success: true, reassignedCount: 1 }` — a response byte-identical in shape
+ * to a healthy run that had exactly one orphan to move. The 99 stayed orphans,
+ * nothing retried them, and no line anywhere recorded that they had been tried.
+ * That is the AGENTS.md durability shape exactly: the system keeps looking
+ * normal while something it claims to have persisted did not land.
+ *
+ * ## What this file pins, and what it deliberately does NOT
+ *
+ * ONLY the silence changes. The loop must still skip the refused row and adopt
+ * the rest — aborting the adoption over one unwritable row would strand the
+ * rows that CAN move — and the response shape is untouched, because adding a
+ * `failedCount` is a contract change this card does not carry. Both halves are
+ * asserted below rather than assumed.
+ *
+ * ## The level, stated so it can be argued with
+ *
+ * `console.error`, not `console.warn`, and not by default: `console.warn` is
+ * this file's overwhelming idiom (51 sites) and `clientFacingRowFailureText`
+ * records the discriminator in prose — it chose `warn` "deliberately — nothing
+ * claimed to be persisted was silently dropped (the row reports
+ * `success: false` and the counters reconcile)". Here NEITHER holds. The
+ * matching precedent is in this same file: `recordPackageCommit` already
+ * answers `console.error` for a refused `sys_metadata_commit` write under a
+ * publish that reports success.
+ *
+ * ## ONE line, not one per row
+ *
+ * AGENTS.md → "Degradation log levels" requires the report be stated once, at
+ * the first occurrence, not once per failed write — and a `sys_metadata` write
+ * that is refused is refused for every row, so the per-row spelling would print
+ * one line per orphan in the environment. The count is pinned, not just the
+ * presence.
+ *
+ * ⚠️ Two cases below are CONTROLS, not pins: they assert an ABSENCE against a
+ * seam that logged nothing at all before this repair, so they stay green in
+ * both directions by construction and are not evidence in an ablation.
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, so this double
+// cannot accept an `update` shape ObjectQL refuses. From
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` — objectql
+// depends on THIS package, so that import would close a cycle turbo rejects.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+interface MetaRow {
+ id: string;
+ type: string;
+ name: string;
+ organization_id: string | null;
+ package_id: string | null;
+}
+
+/**
+ * Engine double over `sys_metadata` with a per-id refusal injector on `update`.
+ *
+ * The injection is keyed by ROW ID rather than being a global switch, because
+ * the defect's dangerous case is the PARTIAL one: an adoption where some rows
+ * move and some do not is the run that answers `success: true` while leaving
+ * orphans behind. A double that could only fail everything could not express
+ * it.
+ */
+function makeEngine(rows: MetaRow[]) {
+ const store = new Map(rows.map((r) => [r.id, { ...r }]));
+ const refuse = new Set<string>();
+ let updateAttempts = 0;
+
+ const engine = {
+ async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+ if (table !== 'sys_metadata') return [];
+ // This double implements NEITHER a `where` combinator NOR a bound,
+ // and REFUSES both rather than answering them silently. Every case
+ // in this file adopts env-wide orphans, so the producer passes
+ // `{ where: {} }` and no `limit`; the org-scoped `$or` branch and
+ // paging belong to tests that do not exist yet. A double looser
+ // than the engine it stands in for converts a green suite into no
+ // suite at all (#4434) — and the reason to refuse rather than
+ // approximate is that the approximation is invisible on the day the
+ // producer starts using the shape.
+ const where = opts?.where ?? {};
+ if (Object.keys(where).length > 0) {
+ throw new Error(`fake engine: unsupported where ${JSON.stringify(where)}`);
+ }
+ if (opts?.limit !== undefined) {
+ throw new Error('fake engine: unsupported `limit` — this double holds no bound');
+ }
+ return [...store.values()];
+ },
+ async update(_table: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+ assertEngineUpdateDispatch(data, opts);
+ updateAttempts += 1;
+ const id = String(opts.where.id);
+ if (refuse.has(id)) throw new Error(`write refused for ${id}: permission denied on sys_metadata`);
+ const row = store.get(id);
+ if (!row) return { id: null };
+ Object.assign(row, data);
+ return { id };
+ },
+ };
+
+ return {
+ engine,
+ store,
+ refuseIds: (...ids: string[]) => ids.forEach((i) => refuse.add(i)),
+ updateAttempts: () => updateAttempts,
+ };
+}
+
+const orphan = (id: string): MetaRow => ({
+ id,
+ type: 'object',
+ name: `obj_${id}`,
+ organization_id: null,
+ package_id: null,
+});
+
+/** The one sentence fragment an operator greps for. */
+const HEADLINE = 'orphaned metadata row(s) were NOT rebound';
+
+afterEach(() => {
+ vi.restoreAllMocks();
+});
+
+function spyConsole() {
+ return {
+ error: vi.spyOn(console, 'error').mockImplementation(() => {}),
+ warn: vi.spyOn(console, 'warn').mockImplementation(() => {}),
+ };
+}
+
+describe('reassignOrphanedMetadata: a refused rebind is reported (#12981)', () => {
+ // ⚠️ CONTROL, not a pin. Before the repair this seam logged nothing at any
+ // level, so "a healthy adoption says nothing" was already true — it stays
+ // green in BOTH directions and is not ablation evidence. It is here so the
+ // pins below cannot pass on a seam that reports unconditionally.
+ it('CONTROL: an adoption in which every row rebinds reports nothing', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(res.success).toBe(true);
+ expect(stub.updateAttempts()).toBe(2);
+ expect(spy.error).not.toHaveBeenCalled();
+ expect(spy.warn).not.toHaveBeenCalled();
+ });
+
+ it('reports a PARTIAL adoption — the run that still answers success: true', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('b', 'c');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Proof the writes were really attempted and really threw — otherwise
+ // every assertion below is about an adoption that never reached the seam.
+ expect(stub.updateAttempts()).toBe(3);
+ expect(stub.store.get('b')!.package_id).toBeNull();
+ expect(stub.store.get('c')!.package_id).toBeNull();
+
+ // ⛔ The response is UNCHANGED: this is the shape that reads healthy.
+ expect(res.success).toBe(true);
+ expect(res.reassignedCount).toBe(1);
+ expect(res.reassigned).toEqual([{ type: 'object', name: 'obj_a' }]);
+
+ // …and it is no longer the only thing that happened.
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ const line = String(spy.error.mock.calls[0][0]);
+ expect(line).toContain(HEADLINE);
+ expect(line).toContain('2 of 3');
+ expect(line).toContain('app.base');
+ // The consequence and the fix, which AGENTS.md requires of this level.
+ expect(line).toContain('STILL orphans');
+ expect(line).toContain('Fix: restore write access');
+ // The driver's own sentence, so the operator is not left guessing why.
+ expect(line).toContain('permission denied on sys_metadata');
+ });
+
+ it('reports a TOTAL refusal, where the response already says success: false', async () => {
+ const spy = spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b')]);
+ stub.refuseIds('a', 'b');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.success).toBe(false);
+ expect(res.reassignedCount).toBe(0);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('2 of 2');
+ });
+
+ it('states the degradation ONCE, not once per refused row', async () => {
+ const spy = spyConsole();
+ const ids = ['a', 'b', 'c', 'd', 'e', 'f'];
+ const stub = makeEngine(ids.map(orphan));
+ stub.refuseIds(...ids);
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ // Six refused writes, ONE operator-facing line — AGENTS.md's "say it
+ // once, at the first degradation, not once per failed write".
+ expect(stub.updateAttempts()).toBe(6);
+ expect(spy.error).toHaveBeenCalledTimes(1);
+ expect(String(spy.error.mock.calls[0][0])).toContain('6 of 6');
+ });
+
+ // ⚠️ CONTROL, not a pin — an INVARIANCE assertion. The pre-repair code
+ // returns exactly this too, so it stays green in both directions. It is
+ // here because the repair would be wrong if it changed control flow.
+ it('CONTROL: a refused row does not abort the rows that can still move', async () => {
+ spyConsole();
+ const stub = makeEngine([orphan('a'), orphan('b'), orphan('c')]);
+ stub.refuseIds('a');
+ const protocol = new ObjectStackProtocolImplementation(stub.engine as never);
+
+ const res = await protocol.reassignOrphanedMetadata({ targetPackageId: 'app.base' });
+
+ expect(res.reassignedCount).toBe(2);
+ expect(stub.store.get('b')!.package_id).toBe('app.base');
+ expect(stub.store.get('c')!.package_id).toBe('app.base');
+ // The response shape is untouched: no `failedCount` was added.
+ expect(Object.keys(res).sort()).toEqual(
+ ['reassigned', 'reassignedCount', 'success', 'targetPackageId'].sort(),
+ );
+ });
+});

packages/metadata-protocol/src/protocol.ts

@@ -17815,6 +17815,28 @@ export class ObjectStackProtocolImplementation implements
  );
 
  const reassigned: Array<{ type: string; name: string }> = [];
+ // [#12981] The refusal channel this loop used to lack entirely.
+ //
+ // The catch below is the card's defining shape, and this method is the
+ // sharpest instance of it in the file: a refused `update` was dropped
+ // whole -- not logged, not rethrown, not carried on the response -- and
+ // the return then reported `success: reassigned.length > 0`. So an
+ // adoption where 99 of 100 orphans were refused answered
+ // `{success: true, reassignedCount: 1}`, byte-identical in shape to a
+ // healthy run with one orphan to move, and the 99 stayed orphans with
+ // nothing anywhere recording that they had been tried. Nothing retries
+ // them and no later boot reconstructs the attempt.
+ //
+ // A COUNTER plus one report AFTER the loop, deliberately, and not a
+ // `console.error` inside the catch: AGENTS.md -> "Degradation log
+ // levels" says an operator-facing degradation is stated ONCE, at the
+ // first occurrence, not once per failed write -- and a refused
+ // `sys_metadata` write is refused for every row, so the per-row
+ // spelling would print one line per orphan in the environment. This is
+ // the same shape #12923's shared refusal accumulator takes at the other
+ // repaired seams of this family.
+ let refusedCount = 0;
+ let firstRefusal = '';
  for (const row of orphans) {
  try {
  await this.engine.update(
@@ -17823,10 +17845,37 @@ export class ObjectStackProtocolImplementation implements
  { where: { id: row.id } },
  );
  reassigned.push({ type: row.type, name: row.name });
- } catch {
- /* skip a row that fails to update; report only what moved */
+ } catch (e: any) {
+ // Control flow is UNCHANGED: a row that cannot be rebound must
+ // not abort the adoption of the rows that can. Only the
+ // silence changes.
+ refusedCount += 1;
+ if (firstRefusal === '') firstRefusal = e?.message ?? String(e);
  }
  }
+ if (refusedCount > 0) {
+ // `error` and not `warn`, by the one question AGENTS.md turns this
+ // on -- after the degradation the system still looks normal from
+ // the outside while something it claims to have persisted did not
+ // land. It is the same verdict, on the same sink, that
+ // `recordPackageCommit` in this file already reaches for the
+ // `sys_metadata_commit` write, and the inverse of the one
+ // `clientFacingRowFailureText` records for its `console.warn`
+ // (there the row reports `success: false` and the counters
+ // reconcile, so nothing was silently dropped; here neither holds).
+ console.error(
+ `[Protocol] reassignOrphanedMetadata: ${refusedCount} of ${orphans.length} orphaned `
+ + `metadata row(s) were NOT rebound to package '${request.targetPackageId}' -- the `
+ + `update was REFUSED. The call still answers reassignedCount=${reassigned.length}`
+ + `${reassigned.length > 0 ? ' with success: true' : ''}, so nothing looks broken, but `
+ + 'those rows are STILL orphans: they keep `package_id` null or the `sys_metadata` '
+ + 'sentinel, this environment has NOT converged on the package-first model (ADR-0070 '
+ + 'D5 completes when an environment has no orphans), and nothing retries them. '
+ + `First refusal: ${firstRefusal}. Fix: restore write access to \`sys_metadata\` for `
+ + 'the system context and run the adoption again -- it is idempotent, rows already '
+ + 'bound to a real package are left untouched.',
+ );
+ }
  return {
  success: reassigned.length > 0,
  reassignedCount: reassigned.length,