install-local: the cached-manifest directory is resolved from the working directory, not OS_HOME, so os dev --fresh rehydrates a previous install #30217

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Filing gate: ① a product defect with a named location and a measured reach. Found by the #30106 dev (os-dev report 6647662239 on #30106, out_of_scope_findings item 2) and first seen by the #30106 filer (comment 6633535319, "Where the cached file lives"). ⛔ Not a claim. No grade: triage sets it.

Business reason: a developer runs os dev --fresh (or a second instance with a different OS_HOME and a fresh database) to start clean, and a package installed by an earlier run comes back. Tests contaminate each other, and in a container whose working directory is not on a volume an install may not survive a container replacement (not measured).

Reader who acts: domain:server, packages/cloud-connection/src/local-manifest-source.ts (default directory) and the CLI serve wiring that constructs the plugin without a storage directory.

Dedupe (open and closed): installed-packages OS_HOME (26 hits, none on this; nearest #30106), LocalManifestSource cwd (4 hits: #30106, #5412, #5612, #5996, the closed three about os doctor's ledger read), fresh install-local cache (88 hits, none on this). New.

What happens (measured by the #30106 dev)

• os dev --fresh, then a managed POST /api/v1/marketplace/install-local, writes CWD/.objectstack/installed-packages/ID.json (measured under examples/app-showcase with a fresh OS_HOME).
• The next --fresh boot rehydrates that entry (measured).

Reading

local-manifest-source.ts defaults to resolve(process.cwd(), DEFAULT_INSTALLED_PACKAGES_DIR); serve.ts constructs the plugin without storageDir; dev.ts states that state not keyed off OS_HOME is not covered by --fresh. Moving the directory needs a read of the old location for existing installs. PR #30207 stops a .custom pair from writing this file at all; other packages still do.

Expected

The cached-manifest directory follows OS_HOME (or the instance's data directory), and --fresh starts without earlier installs.