plugin-sharing: INFO line when isSystem writes cover an active sharing rule but materialise zero grants (demand 3 of #4707, maintainer-ruled 2026-08-06)

[os-zhuang]

Part of #4707. Execution sub-card cut by the triage seat per the maintainer's 2026-08-06 ruling recorded on that thread (demand 3 = do).

Task

When a seed run (or any isSystem write batch) writes rows to an object covered by an active sharing rule and materialises zero grants because the record-write hooks skip isSystem sessions, emit one INFO line naming the behaviour and the remedy, per the ruling's wording: include the guidance "sharing materialisation skipped for isSystem writes; re-evaluate rules or restart to backfill".

Anchors (re-verified on origin/main @ e1e7629)

• The skip itself: packages/plugins/plugin-sharing/src/rule-hooks.ts:157, :165, :180, :194 — each record-write hook returns early on (ctx?.session as any)?.isSystem.
• The eventual heal the INFO line should point at: the boot backfill (sharing-plugin.ts, whose own comment at :47 documents that seed rows are written with isSystem and the hooks deliberately skip them).
• The original symptom (hotcrm#640): fresh install, 9 active rules, 9 matching accounts, sys_record_share empty — every visible layer said "configured", nothing said "inert".

Shape notes for the dev (from the parent card, not a ruling)

• The signal must be one line per seed run/batch, not per row — the failure mode being fixed is silence, not verbosity.
• Behaviour is otherwise correct (boot backfill heals it); ⛔ do not change the skip itself, and do not make the INFO an error/warn — the ruling asked for INFO.
• Demand 2 of the parent is decided (the flag is NOT being split); this card must not introduce any new switch.

Scope

packages/plugins/plugin-sharing only (identity lane).

Refs: #4707 (anchor card — closure rides on the sub-cards landing), hotcrm#640 / PR hotcrm#652, sibling devx sub-card for demand 1.

[os-zhuang]

Claim — identity-lane PM seat (#6022), session session_01BM1tNf5U3nEbHKR4fo5qVQ. Dispatching to an os-dev subagent now.

• Branch: claude/issue-6783-issystem-zero-grant-info
• Worktree: ../objectstack-issue-6783 (dedicated per-task worktree; never the shared checkout)
• Domain: domain:identity — label untouched (single-producer rule)
• Status: pm:queue → pm:dispatched. No blocker; the shape is already maintainer-ruled (2026-08-06, demand 3 = do, recorded on parent isSystem: true has at least three distinct, undocumented side effects across three packages — each one has cost an app-side bug #4707), so this is execution, not a decision.
• File surface (expected): packages/plugins/plugin-sharing only — rule-hooks.ts (the isSystem early-returns at :157/:165/:180/:194) and sharing-plugin.ts (the boot backfill the INFO line points at).
• Serial constraints cleared: plugin-sharing production files are free — PR fix(sharing): defer to an app-authored RLS widener before hard-refusing a by-id write (#5493) #6909 (On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493) merged 2026-08-09T04:08:21Z and closed this lane's only other plugin-sharing claim; nothing else in this batch touches the package.
• ⛔ Boundaries restated for the claimant: one INFO line per seed run/batch, not per row; do not change the skip itself; do not promote it to warn/error; do not introduce any new switch (demand 2 is decided — the flag is not being split).

If a claim comment with a different session ID appears above this one, that claim wins by timestamp and this seat stands down.

---

Generated by Claude Code