fix(plugin-sharing): defer rule backfill to kernel:listening so seed rows materialize (#2926 ③)

The boot backfill ran inside a kernel:ready handler, but SeedLoader also
seeds on kernel:ready (raced against a budget, in a different AppPlugin
handler). Since kernel:ready handlers fire sequentially in registration
order, the backfill could run before the seed records exist and materialize
nothing. Move the reconcile to kernel:listening (Phase 4), which the kernel
fires only after every kernel:ready handler has settled — so the seeded rows
are present. Verified end-to-end: a seeded red project now yields a
sys_record_share to the exec recipient at boot, no runtime touch required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bJWtKmZ2mFpRFAmmmoeqe

Author: claude

.changeset/sharing-2926-boot-backfill.md

@@ -2,4 +2,4 @@
 '@objectstack/plugin-sharing': patch
 ---
 
-fix(plugin-sharing): reconcile every active sharing rule once at boot (#2926 ③). Rule grants are materialized by write hooks, which deliberately skip `isSystem` writes — so seed-loader records never produced `sys_record_share` rows and demo data shipping with matching sharing rules was broken out of the box until each record was touched at runtime. The new boot backfill runs after the rule hooks bind, is idempotent (diff-based reconcile), and is best-effort per rule so one broken rule cannot block startup.
+fix(plugin-sharing): reconcile every active sharing rule once at boot (#2926 ③). Rule grants are materialized by write hooks, which deliberately skip `isSystem` writes — so seed-loader records never produced `sys_record_share` rows and demo data shipping with matching sharing rules was broken out of the box until each record was touched at runtime. The boot backfill runs on `kernel:listening` — the phase the kernel fires only after every `kernel:ready` handler has settled, including the AppPlugin seed loader — so the reconcile sees the seeded rows rather than racing them. It is idempotent (diff-based reconcile) and best-effort per rule so one broken rule cannot block startup.

packages/plugins/plugin-sharing/src/sharing-plugin.ts

@@ -307,7 +307,12 @@ export class SharingServicePlugin implements Plugin {
             unbindRuleProvenanceStamp(engine);
             bindRuleProvenanceStamp(engine, ctx.logger as any);
 
-            await backfillRuleGrants(this.ruleService, rules, ctx.logger as any);
+            // [#2926 ③] Reconciling existing rows against every rule is
+            // deferred to `kernel:listening` (below): seed data is loaded on
+            // `kernel:ready` (raced against a budget, and the AppPlugin's seed
+            // hook is a *different* kernel:ready handler), so a backfill here
+            // would race the very records it must materialize. `kernel:listening`
+            // fires only after every kernel:ready handler has settled.
           } else {
             ctx.logger.warn('SharingServicePlugin: engine has no hook API — sharing rule auto-evaluation disabled');
           }
@@ -388,6 +393,23 @@ export class SharingServicePlugin implements Plugin {
         ctx.logger.warn('SharingServicePlugin: share-link subsystem not started', { error: err?.message });
       }
     });
+
+    // [#2926 ③] Materialize sharing grants for rows already present at boot —
+    // notably SeedLoader-inserted seed records, whose write goes through the
+    // isSystem short-circuit in the rule hooks and therefore never produces a
+    // `sys_record_share`. Runs on `kernel:listening` (Phase 4), after every
+    // `kernel:ready` handler — including the AppPlugin seed loader — has
+    // completed, so the reconcile sees the seeded rows. Idempotent: a runtime
+    // write that already materialized a grant is reconciled to the same state.
+    ctx.hook('kernel:listening', async () => {
+      if (!this.ruleService) return;
+      try {
+        const rules = await this.ruleService.listRules({ activeOnly: true }, { isSystem: true } as any);
+        await backfillRuleGrants(this.ruleService, rules, ctx.logger as any);
+      } catch (err: any) {
+        ctx.logger.warn('SharingServicePlugin: boot rule backfill (kernel:listening) failed', { error: err?.message });
+      }
+    });
   }
 }