packages: an uninstall leaves no sys_audit_log row for the package itself (the sys_packages delete is raw SQL, so no actor can reach it) #31186

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

Filing gate: ① product defect (audit gap on a package lifecycle write), split from #31023 Expected line 1 during its delivery (PR #31183, dev report 6709857870, open question 1). ⛔ Not a claim. Triage sets the grade and the lane.
Reader: the domain:server seat that owns packages/services/service-package and the package doors in packages/runtime/src/domains/packages.ts.
Dedupe (open AND closed): sys_packages audit uninstall → 15 hits, the only match is #31023 (the source card); "package lifecycle" audit → 243 hits, none about an audit row for the package row itself.
reach: DELETE /api/v1/packages/:id and every in-process deletePackage caller; read from the code on main 21c1f74, not run.
class: c · type: Bug

维护者速读

在 Studio 里卸载一个应用后，审计日志能看到它的每条元数据是谁删的（#31023 / PR #31183 补上了），但「这个包本身被卸载了」这件事没有任何审计记录：包表的那一行是用原始 SQL 删掉的，不走钩子，所以连写审计的机会都没有。安装、启用、停用同样只在元数据层留痕。

What is wrong

• packages/services/service-package/src/index.ts ~631 deletes the package row with DELETE FROM sys_packages WHERE id = ? through engine.execute. That path fires no hooks, so no sys_audit_log row is written for it, with or without an actor. PackageService.delete(id) takes no actor either.
• packages: DELETE /api/v1/packages/:id deletes unattributed (no actor), and the in-process deletePackage leaves the per-environment disable record behind #31023 asked that "both the metadata deletes and the sys_packages delete are attributed in sys_audit_log". PR fix(runtime): attribute the package DELETE and clear the disable record in the uninstall verb #31183 delivers the metadata half (each removed metadata row names the person, via resolvePackageWriteActor). The sys_packages half cannot be met by passing an actor, because there is no audited write to attribute.

Expected

• A package-lifecycle audit row (at least uninstall; the design decides whether install / enable / disable join it) naming the actor, the package id and version, and the environment, written for every caller of the uninstall verb, not only the HTTP door.

Design question (for triage / the decision box if needed)

• One audit writer on the package service (signature gains an actor) vs. a lifecycle event the audit plugin subscribes to. The audit log's object model decides which; this card does not pick.

Consumer: objectstack-ai/cloud#3656 (its uninstall tool passes an actor and calls the in-process verb).