Lab #834: fix: datastore sync --push deletes the namespace registration manifest (canonical namespace flow un-registers itself)

Summary

swamp datastore sync --push deletes the {namespace}/.namespace.json registration manifest from the bucket. registerNamespace() writes the manifest directly to the object store and never materializes it into the local cache, so a namespace-scoped push treats it as a remote orphan and removes it. The canonical multi-repo flow — namespace set -> namespace migrate --confirm -> sync --push — therefore silently UN-registers the namespace it just registered: namespace list returns empty and repoId conflict-detection is defeated.

This is NOT "namespace set doesn't call registerNamespace" — it does, correctly (per #542). The manifest is written by set, survives migrate (local-only), and is destroyed by the following push.

Repro (minimal; @swamp/gcs-datastore; isolated throwaway prefix)

swamp repo init
swamp extension pull @swamp/gcs-datastore
swamp datastore setup extension @swamp/gcs-datastore --config '{"bucket":"B","prefix":"P","projectId":"..."}'   # NO namespace
swamp datastore namespace set ns
#   -> gs://B/P/ns/.namespace.json EXISTS
swamp datastore namespace migrate --confirm
#   -> manifest still EXISTS (migrate is local-only; prints "run sync --push")
swamp datastore sync --push
#   -> "Pushed 1 files"; gs://B/P/ns/.namespace.json is now GONE
swamp datastore namespace list   # -> "No namespaces registered in this datastore"

Control: set -> push WITHOUT an intervening migrate pushes 0 files and does NOT delete the manifest. The deletion happens specifically during a push that actually syncs the namespace subtree (checkpointed: manifest present after set and after migrate, absent immediately after push).

Root cause (hypothesis)

registerNamespace (datastores/gcs.ts) writes {namespace}/.namespace.json straight to the bucket; it is not part of the local cache tree. The namespace-scoped push reconciles the remote {namespace}/ subtree against the local cache and deletes remote objects with no local counterpart — including the manifest. Push should treat .namespace.json (and other reserved manifest/index files like .datastore-index.json/.catalog-export.json) as protected, not orphans.

Impact

The documented canonical flow (set -> migrate -> sync --push, manual "Add a namespace to an existing repository") destroys its own registration.
namespace list -> empty; foreign-catalog discovery (listNamespaces) cannot enumerate the namespace.
repoId conflict-detection is inert: a second repo can claim the same namespace undetected.
Data isolation (driven by the .swamp.yaml namespace, not the manifest) still works, so this is SILENT — the layout looks correct while registration is gone. Re-creating the manifest by hand is only temporary: the next sync --push deletes it again.

Environment

swamp 20260626.005336.0-sha.f302d18e; @swamp/gcs-datastore. Confirmed on a live GCS datastore and reproduced twice in clean throwaway prefixes.

#547 (extensions implement registerNamespace), #542 (namespace set registers manifests), #559 (setup-with-namespace-config path) — this is a distinct sink: push deletes what set wrote.

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

Extension: @swamp/gcs-datastore@2026.06.24.1
swamp: 20260626.005336.0-sha.f302d18e
OS: linux (x86_64)
Deno: 2.8.3
Shell: /bin/zsh

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Datastore rework Phase 5 (team mode) 2/3: the CLI's serve upstream — with serverAddress, a v3 checkout commits, reads chunks and catches up through serve's datastore API, with no storage credentials

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

Rescore every extension's current version under rubric v5

Extension scoring queue: two replicas can claim the same pending event

Scheduled flaky-test detection is failing

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

Filesystem datastore: an unclean shutdown leaves zero-byte data versions as the latest version, and `doctor datastores --repair` does not detect them

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

extension install and extension pull leave different bundles for the same extension version

Registry drops contentMetadata.extensions (method grafts) at confirm-push

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

extension pull: safety analysis scans the bundle the extension runs

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json