An unmanaged install can copy the package's seed data, removable as one batch, owned by the installer (gallery demos need data) #30808

epic:#3600#1 · hotlong · session_01Q4EjjPXwX1YfHyKJUh4agu

Filing-gate category: ② maintainer-directed task. Maintainer, verbatim (Claude Code session, 2026-11-06): 「同意」, approving the seat's proposal that an unmanaged install copy seed data (gallery demos need data to answer questions). The analysis was re-read by an isolated contract-review-tier reviewer before filing; its fixes are folded in. Routing, verbatim: 「能交给车队开发的你不要自己开发」. Epic context: objectstack-ai/cloud#3600.

Blocked-by: #30794

Problem (customer-visible)

A template installed as the customer's own copy arrives empty: the unmanaged import copies metadata only and classifies seeds as data (packages/metadata-protocol/src/package-unmanaged-install.ts:44-56; #15213 Q3 = A as built: the reseed and purge doors act on install-ledger entries, and an unmanaged install writes none). A visitor who tries a gallery app in one click gets an app with no rows, so nothing can be asked of it.

Governing rulings (do not re-decide)

• Ownership: [Decision] An installed app's sample data has no owner, so a colleague opening the app sees none of it #30324 (ruled 2026-11-05, option C) and its hosted-cloud twin [Decision] cloud: sample rows an app install seeds on a hosted environment may have no owner — apply #30324's rule (owner = the installer, ordinary permissions, no exception) #30680 (decision card on this repo, answered A on 2026-11-06). Sample rows get owner_id / created_by = the installer, ordinary permissions, no sample-data read rule. Consequence to state in the PR: rows the card owned by different personas collapse to one owner, so per-role answers in the customer's environment differ from the gallery's recorded per-persona transcripts. The gallery proves per-role behaviour through those transcripts, not live.
• Rename: objects in seed rows follow the An unmanaged install can take a target namespace: the copy is re-namespaced at install through the duplicate-package rename engine #30794 rename map.

Ask

1. An optional seed copy on the unmanaged import and the install-local door, off by default. The hosted deep link (cloud#3626) turns it on.
2. Removal without a new per-row key. Prefer storing a seed receipt for the unmanaged copy in the environment ledger, so the existing purge identity (an externalId match against the stored seed body, marketplace-install-local-purge.ts:8-18) removes exactly the sample rows. A marker column is the alternative; weigh both in the PR and choose the one that adds no key unless it cannot work.
3. Keep externalId stable under the An unmanaged install can take a target namespace: the copy is re-namespaced at install through the duplicate-package rename engine #30794 rename, so purge still matches.
4. Resolve lookups between seeded rows in load order, as the managed path does.
5. A re-run stays refused (409: the -copy target exists, feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213).
6. Seeds carry no file blobs; say so in the PR. Plan quotas are unverified: check whether a seed copy counts against record quotas and state it.

Precedent for size: #15213 S2 (+2,433/−169, 40 files) built the import itself.

Reader: the domain:engine lane seat, from pm:queue once #30794 closes.

Generated by Claude Code