[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR

Filing gate ③: a task the maintainer dispatched, quoted verbatim below. Filed by domain:services seat 1 (seat post #6021) · os-sales · session session_016g7nYP9wdNx1GDa5XDr7Uy, as the domain:engine half of #24586's restart act. That half was handed over unfiled in 6341834009, and the engine surface is now this project's, folded into domain:server by PR #25247. ⛔ Not a claim.

The maintainer's words, verbatim (#24586, recorded in 6270097840): 「24586 同意A，是否建议这波分拆等 v18 发布之后再处理。」 Triage read the restart condition (npm @objectstack/spec latest ≥ 18.0.0) as true in 6291735609. The ruling's restart act: "one [maintainer] card per file over 10,000 lines into its owning lane … Each card starts with a fresh seam measurement taken at that time, in #23050's shape", and "protocol.ts goes first".

Reader who acts: the domain:server lane, engine surface (packages/metadata-protocol was domain:engine's). One dispatch per slice.

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

Size and churn:
- 33,065 lines, up from 22,896 thirty days ago (dabf8d795e, the last commit before 2026-09-23T15:00Z): +10,169, +44.4%.
- 28 commits in 7 days and 184 in 30 days.
- git blame --since=2026-09-23T15:00Z attributes 13,445 lines (40.7%) to the last 30 days.
Structure:
- a 6,643-line module preamble: helpers, three error classes, and the query-param and filter vocabulary;
- one ObjectStackProtocolImplementation class, lines 6644–32941 (26,298 lines, 267 members);
- a 124-line trailer of package-persist helpers.
The sections, by contiguous member ranges:

section	lines	lines from the last 30 days
module preamble (helpers, error classes, query-param and filter vocabulary)	6,643	2,255
class head, flow/SDUI resolvers, registration hooks, authoring gates, mutation pub/sub, overlay index	1,961	707
discovery, types, diagnostics, packaged bases, credential carry-forward	1,578	339
metadata reads (`getMetaItems`, `readFlattenedMetaItems`, overlay rows, `readMetaItem`, layered, audit, `getUiView`)	2,872	1,696
query validation (`assertFieldsExist`, `refuseInternal`)	1,643	358
data CRUD (`findData` … `readAsCaller`)	1,393	274
`searchAll` + meta cache	605	160
batch and `*Many` data	1,067	33
write gates (overlay/code-only/organization/sealed/packaged-base, locks, version tokens, conflict audit)	2,619	1,772
registry hydration, view expansion, write-through, object storage	1,996	1,112
save refusals, `saveMetaItem` (1,535 lines alone), `saveConflict`, `migrateStoredMetadata`	2,960	1,666
history, publish, drafts, publish backfill (`publishPackageDrafts` 969 lines)	2,600	828
package revert/delete/duplicate/import, orphans, commits, `revertCommit`, rollback	2,837	1,335
diff, `deleteMetaItem`, `loadMetaFromDb`, load reports, `findReferencesToMeta`	1,831	624
install/update package + module trailer	460	286

Shared state a split must pass:
- The fields are engine (149 refs), getServicesRegistry (16), environmentId (11), the cluster pub/sub trio (clusterPubSub, clusterNodeId, clusterUnsubscribe), the two listener sets, authoringChannel, and about 20 warn-once and cache flags.
- Coupling is mostly method-to-method: 597 this.X( calls over 206 distinct members. Reads, write gates and saves call one another across the sections above.
What reads it by path:
- The ADR anchor file scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json. It holds ADR-0005, 0029, 0087, 0119 and 0126, and its invariant names the two object-hydration seams applyObjectRegistryMutation and loadMetaFromDb. The metadata-plugin.zod.ts anchor file and scripts/symbol-anchors.mjs also name the file.
- 10 more files under scripts/: check-durability-degradation-log-level.mjs, check-engine-double-contract.mjs (+ .pinned.json, .seams.json), check-filter-alias-parity.mjs, check-nul-bytes.mjs, check-system-context-census.mjs, docs-audit/affected-docs.mjs, objectql-double-limit.baseline.json, query-options-erasure-baseline.json.
- 22 files under docs/ and content/, 11 of them ADRs.
- Tests: 180 test files in metadata-protocol import it, and 71 files in other packages name it by path.
In flight: none of the 21 open PRs touch the file.

The ask (from #24586's ruling and #23050's shape)

Split along the existing seams, one area per PR. Each slice is move-only: no logic changes.
Shared state stays explicit: moved code reaches the class's shared members through one named context object (the host pattern of [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050, [maintainer] refactor(service-automation): split src/engine.ts (13,735 lines, +2,199 in 30 days) along its AutomationEngine seams, one move-only slice per PR #25222, [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 and [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). ⛔ Not a second copy of a helper, ⛔ not a re-derivation.
Every slice proves it moved nothing:
- every gate, baseline, ADR anchor and docs anchor that reads the file by path is migrated in the same PR and stays green;
- the ADR-0029 D9.8/D9.9 invariant's two seams keep a resolving anchor;
- the package's public .d.ts stays identical.
- ⛔ A gate whose target moved must not go silently empty.
Serial with the file's in-flight PRs: a slice waits for an open PR on the same region, or that PR merges main after the slice. At 28 commits a week, every slice measures the file's open PRs again at claim.
⛔ No new gate.

Not in this card

Any behaviour change.
A design change to the shared members beyond giving them an explicit context.
objectql/src/engine.ts (23,903 lines) and driver-sql/src/sql-driver.ts (22,096 lines). They are the other two engine-surface files under the same ruling, and they are filed once this card's first slices have landed ([Decision] Split the platform's largest, fastest-growing source files (protocol.ts 32,428 lines, +10,002 in 30 days) the way rest-server.ts was split, or leave them #24586's order: protocol.ts first).
spec/src/conversions/registry.ts, which belongs to domain:spec.

Dedupe

MCP search_issues on this repository, closed included, with two queries:

"split protocol.ts metadata-protocol move-only maintainer refactor"
"refactor split objectql engine.ts sql-driver.ts large file"

The hits were #24586 (the ruling this card carries out), #25222, #25223 and #25224 (the domain:services files), and #23050 (closed, rest-server.ts). None covers protocol.ts. New.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 1 (one PR; cuts strictly serial) · 2026-10-23T15:20Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, cut from origin/main ab510f4c43; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 21 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act against origin/main; #25451 touches only protocol.runtime-authoring-gate.test.ts, the Version Packages PR #24876 only CHANGELOG.md / package.json). No pm:dispatched card's claimed file surface names the file. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main ab510f4c43, where protocol.ts is 33,065 lines):

Cut 1 = the card's "batch and *Many data" section (the seat's suggested first slice: 1,067 lines, 33 of them from the last 30 days). Sixteen ObjectStackProtocolImplementation method bodies move unedited from packages/metadata-protocol/src/protocol.ts into a new module, packages/metadata-protocol/src/protocol-batch-data.ts, in the host shape of #23050 / #25222 / #25223 / #25224:

public: batchData :16696, createManyData :17263, insertManyData :17348, updateManyData :17390, deleteManyData :17574;
private: runAtomicBatchData :16739, runAtomicBatch :16775, runBatchDataLoop :16850, reconcileStoppedBatch :17108, locateBatchCause :17170, buildBatchDataResponse :17182, buildRolledBackBatchResponse :17219, runUpdateManyLoop :17424, buildUpdateManyResponse :17497, runDeleteManyLoop :17619, buildDeleteManyResponse :17708.
triggerAutomation :17527 sits between them but is not batch code; it stays.

How the host is built:

The class keeps every method, with its docblock, signature and position; each body becomes a literal of exactly the members it reads, plus a .call. async is dropped from the stubs, which return the moved function's promise.
Members read, measured by AST: engine (field), and the methods assertObjectRegistered, assertRecordExists, probeRecord plus the moved methods' calls to one another. Methods go as late-bound closures, so a spy or double set on the instance is still the one a body reaches. engine goes as a getter.
The only outside caller of a moved method is applyPublishBackfill (this.updateManyData(), which keeps calling the class method.

Module-level declarations the moved bodies read (all stay in protocol.ts; each has readers outside the moved text except mergeDroppedFieldEvents, which stays too, so no declaration moves):

export added in place, imported back by value or type from ./protocol.js: byIdUpdateRecord, mergeDroppedFieldEvents, rowOperationFailureFallback, rowRequiredIdError, toRowApiError, type BatchDataRowResult, type BatchDataLoopOutcome. src/index.ts exports from ./protocol.js by name, so none of them is published; the proof measures it (raw .d.ts and ESM/CJS export lists base vs head). Every value import is read only inside function bodies, so the module cycle is evaluation-safe; the PR lists each read site.
Imports the new module takes from packages directly (as protocol.ts does): engineCanRollBack, recordNotFoundError (@objectstack/core), omitInternalFieldsFromWriteResponse (./write-response-internal-fields.js), and the @objectstack/spec types the bodies name.

Path readers migrated in the same PR (each measured base vs head in the PR):

scripts/adr-anchors/: the protocol.ts entry's ADR-0119 paragraph describes batchData's atomic path, which moves. Per the series' rule, the new module gets its own entry carrying ADR-0119 and that paragraph verbatim; the protocol.ts entry is unchanged (ADR-0119 is still cited at five sites outside the moved text). check:adr-anchors decision-letter totals reported base and head.
protocol.bracketed-refusal-opener-absence.test.ts: the moved text holds 5 new Error( sites, so the new module joins its PRODUCERS list with a measured floor; otherwise those sites would leave the scan silently. protocol.ts keeps its floor of 5.
docs/adr/0119-…md anchors protocol.ts#batchData: the method shell stays, so it still resolves; check-adr-symbol-anchors run by hand at both ends.
Census and ledgers run base and head: tenant-audit census (the moved bodies hold engine insert/update/delete calls; if they shift class, --write plus the page's prose count, with a per-site base/head comparison), system-context census (0 isSystem reads in the moved text), query-options erasure ratchet (0 counted find/findOne/count/aggregate sites in the moved text), engine-double contract seams (deleteData / updateData rows, which stay), durability log level (scans the whole package).

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the export keywords above and the stub bodies; no ADR or docs/adr/** text is edited; no new gate. One PR, skip-changeset (no behaviour change), Part of #25467.

Proof the PR carries: AST leaf-token identity of every moved body (with a one-token negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff line count, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head (same counts), dispatch-gates --commands all run with exits, and the hand gates above.

Landed cut 1 (batch and *Many data) · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T17:23Z

reading	value
PR #25494	MERGED through the queue (the seat's ACCEPT is on the PR), head `b55faf2162`
`origin/main`	carries `bf5855b5bc`

State: the card stays open and dispatched (Part of). The card thread plans cut 2 on the merged protocol.ts and re-checks the in-flight PRs on the file first (serial rule). It claims cut 2 afresh before it pushes.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 2 (one PR; cuts strictly serial; cut 1 landed as #25494, bf5855b5bc) · 2026-10-23T17:30Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main 5188e7f18f after cut 1 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope agreed with the seat before this claim; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 12 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act, the Version Packages PR #24876 paged through all 395 files: only CHANGELOG.md / package.json in this package). Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main 5188e7f18f, where protocol.ts is 32,468 lines):

Cut 2 = the discovery and diagnostics bodies from the card's "discovery, types, diagnostics, packaged bases, credential carry-forward" section: about 800 lines, 42 of them from the last 30 days (5%, the coldest slice left). Three ObjectStackProtocolImplementation method bodies move unedited into a new module, packages/metadata-protocol/src/protocol-discovery.ts (host DiscoveryHost), in the shape cut 1 used (#23050 shape B):

public: getDiscovery :8570, getMetaDiagnostics :9257;
private: listLiveMetadataTypes :9059.
Members read, measured by AST: engine (field, as a getter), and the methods getServicesRegistry, searchAll, getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked (late-bound closures).

Stays, deliberately:

getMetaTypes :9077, between them: its body reads the private static ObjectStackProtocolImplementation.envWritableTypes(), which a module function cannot reach unedited (private statics stay, as in [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). TYPE_TO_FORM, HAND_CRAFTED_SCHEMAS and toJsonSchemaSafe, read by it, stay with it. It keeps calling listLiveMetadataTypes through the class.
getProjectId :8566: its body is no longer than its stub would be.

Module-level declarations:

SERVICE_CONFIG :5498 is read only by getDiscovery: it moves with it, unedited with its docblocks, unexported.
type ShippingPackages :2304 is read by code that stays too: export added in place, imported back as a type. src/index.ts exports from ./protocol.js by name, so it is not published; the proof measures it.
The module imports from the same specifiers protocol.ts uses (@objectstack/spec/api, /system, /kernel, @objectstack/core, ./discovery-version.js, ./metadata-diagnostics.js, ./item-lock.js).

Readers (measured; the PR reports each base vs head):

scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9 hydration seams, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. The decision letters inside the moved bodies leave the anchored surface; the exact check:adr-anchors count is reported base → head.
docs/qa/platform-checklist/areas/studio-authoring.json anchors protocol.ts#getMetaDiagnostics: the method shell stays, so it still resolves; not edited; check-platform-checklist at both ends.
None in the moved text: isSystem reads (system-context census), engine find/findOne/count/aggregate (erasure ratchet), engine update/delete seams (engine-double contract), new Error( (bracketed-refusal PRODUCERS), and none of the package's source-scanning pins' patterns.

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the one export keyword and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cut 1: AST leaf-token identity of every moved body (with a negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head, dispatch-gates --commands all run with exits and --ran, and the hand gates (check-adr-symbol-anchors, check:adr-anchors with letters, censuses, check-platform-checklist) at both ends.

Claim amendment: cut 2 of #25467 (amends claim 6370841668) · domain:services seat 1 (seat post #6021; 由Sales账户的项目负责) · 2026-10-23T17:45Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Branch: claude/project-thread-uasfag (unchanged, base origin/main 5188e7f18f)
Seat: domain:services#1 (the narrowed scope below agreed with the seat before this amendment)
Thread-read: 6370841668

Narrowed scope. Cut 2 is getMetaDiagnostics alone (:9257). Its body moves unedited into packages/metadata-protocol/src/protocol-meta-diagnostics.ts (host MetaDiagnosticsHost, members read: getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked, as late-bound closures). type ShippingPackages gains export in place, as claimed. getDiscovery, listLiveMetadataTypes and SERVICE_CONFIG leave this cut and stay in protocol.ts; nothing else in the claim changes.

Why getDiscovery cannot move (measured, nothing pushed). It is public and its return type is INFERRED (async getDiscovery() {), so dist/index.d.ts prints the type the compiler infers. With its body moved in this series' shape, the stub's type is inferred from the new module, and the emitted .d.ts changed in two ways that are not union-member order: it dropped a property docblock (@deprecated Use name. Removed in protocol 18 (#4828).), and it spliced about 100 lines of an unrelated protocol.ts docblock (the save door's hook-without-body refusal) into a nested description property. Base raw 8e1a224c…, trial head raw fc33e319…; normalised (ruling 6348891160's normaliser) base 5b98a8e8…, trial head different, normalised diff 111 lines. Under ruling 6348891160 that is a stop, not a pass. The token proof and the package suite were clean on that trial; only the published surface moved. listLiveMetadataTypes' body is barely longer than its stub, and SERVICE_CONFIG is read only by getDiscovery, so both stay with it.

Carry-forward for later cuts. A public member with an inferred return type stays in protocol.ts in this series: annotating it would be a signature edit, which needs a ruling. Measured on 5188e7f18f, the public members with no declared type: getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem.

Decision letters: one leaves the anchored surface with the body (ADR-0110 D3); measured check:adr-anchors 1,979 → 1,978, reported in the PR.

Landed cut 2 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T19:27Z

reading	value
PR #25518	MERGED through the queue (ACCEPT `6372365108`), head `9f403be528`
`origin/main`	carries `b2411c001d`

State: the card stays open and dispatched (Part of). The card thread claims the next cut afresh on the merged protocol.ts. Public members whose return type is inferred stay in the class.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 3 (one PR; cuts strictly serial; cut 1 landed as #25494 bf5855b5bc, cut 2 as #25518 b2411c001d) · 2026-10-23T19:38Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main b2411c001d after cut 2 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope A agreed with the seat before this claim, with its conditions carried below; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 9 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's diff against its merge base read in this act; the Version Packages PR #24876 touches only CHANGELOG.md / package.json in this package). origin/main (f38832be9c) has not touched this package since b2411c001d. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main b2411c001d, where protocol.ts is 32,309 lines):

Cut 3 = the query validation: the section :12797–:14502 (1,706 lines, 382 of them from the last 30 days). Nineteen PRIVATE ObjectStackProtocolImplementation methods move unedited into a new module, packages/metadata-protocol/src/protocol-query-validation.ts (host QueryValidationHost), in the shape cuts 1–2 used (#23050 shape B):

assertObjectRegistered :12861, resolveQueryFields :12933, assertQueryParamsAreFields :12961, assertFilterFieldsExist :13064, assertSortFieldsExist :13358, assertProjectionFieldsExist :13546, assertExpandTargetsExist :13670, assertSearchFieldsAreSearchable :13793, assertGroupByFieldsExist :13988, assertAggregationFieldsExist :14103, assertNoInternalFieldEvaluated :14283, refuseInternalInFilter :14313, refuseUnservedRelationTarget :14346, refuseInternalInExpand :14373, servedExpand :14429, servesExpansionTarget :14454, orderByFieldNames :14460, groupByFieldNames :14469, refuseInternalNames :14478.
All private, so the published .d.ts prints no type for any of them: none is on the series' skip list of public inferred-return members.
Members read, measured by AST: engine (field, as a getter), and the methods assertFilterFieldsExist, groupByFieldNames, orderByFieldNames, refuseInternalInExpand, refuseInternalInFilter, refuseInternalNames, refuseUnservedRelationTarget, resolveQueryFields, servedExpand, servesExpansionTarget (late-bound closures, so the recursive walks still go through the protocol).

Module-level declarations, each measured by an AST reader walk over all of protocol.ts (identifier references outside the declaration itself):

Move with the bodies, byte-identical, unexported (no reader outside the moved bodies and the other moved declarations): nestedRelationRoute :392, warnedNoRegistryForDataGate :536 (the mutable let: its only reads and its only write are in assertObjectRegistered, so the state moves whole and is never copied), AGGREGATION_FUNCTIONS :4489, DATE_GRANULARITIES :4490, UNMATERIALIZED_SORT_TYPES :4892, invalidQueryError :4988, suggestQueryParam :5131, collectFilterFieldKeys :5217, INTERNAL_FIELD_WALK_DEPTH :5321, EXPANSION_TARGET_OPERATION :5337, RELATION_CONDITION_TARGET_OPERATION :5348. Their initialisers read only package imports or nothing, so module evaluation order is unaffected.
Stay and gain export in place (read by code that stays, or by a moved helper and by code that stays): collectFilterReads (← collectStoredMetadataFilterFields), invalidSortError (← normalizeSortNodes, invalidSortDirectionKeyError), isObjectOfDisabledPackage and objectPackageDisabledError (← readMetaItemFace, getMetaItemLayered), isPlainRecord (← storableEqual, soleMovedFrom, buildStorableViewNode), suggestFieldName, FILTER_LOGICAL_KEYS, QUERY_PARAM_NEAR_MISS, nearMissKey, ODATA_SPELLING. src/index.ts exports from ./protocol.js by name, so none is published; the proof measures it.
protocol.ts drops the import names that lose every reader (noUnusedLocals); the module imports them from the same specifiers.

Readers (measured; the PR reports each base vs head):

protocol.bracketed-refusal-opener-absence.test.ts PRODUCERS: 17 new Error( sites move (16 in the methods, 1 in invalidQueryError); protocol.ts 104 → 87 against its floor 5, and the new module is listed with its measured floor, 17.
scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. check:adr-anchors decision letters are reported exactly base → head.
docs/qa/platform-checklist/areas/api-backend.json and search.json anchor protocol.ts# moved methods: the method shells stay, so they still resolve; not edited; check-platform-checklist at both ends.
Censuses, the query-options erasure baseline, the engine-double contract seams and the package's source-scanning pins are each run at both ends.
Size: under the 3,000-changed-line bar (measured: +1,591 / −1,283 over 3 files).

⛔ Nothing else changes: no moved body or declaration is edited; the only stay-behind edits are the ten export keywords, the narrowed import lists and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cuts 1–2: AST leaf-token identity of every moved body and declaration (with a negative control), the declaration reader table, .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head compared per test, dispatch-gates --commands all run with exits and --ran, and the hand gates at both ends.

Landed cut 3 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T22:03Z

reading	value
PR #25538	MERGED through the queue (ACCEPT `6375081284`), head `3b1ae50413`
`origin/main`	carries `798d480269`

State: the card stays open and dispatched (Part of). The card thread claims cut 4 afresh on the merged protocol.ts. #25533 also edits protocol.ts (publishDrafts). Its merge-tree is clean, but its byte offsets have shifted, so its .d.ts is re-read before it lands.

Generated by Claude Code

Landed

PR #27029 merged at 2026-10-28T04:39Z by the merge queue as 68748c39bc on main (Part of #25467; ACCEPT 6459164123).

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-27029-*'`	0 refs
`origin/main` by content	`git cat-file -e origin/main:packages/metadata-protocol/src/protocol-legacy-organization-rows.ts`	present
Ancestry	`git merge-base --is-ancestor 68748c39bc origin/main`	holds

State: card stays open (Part of), pm:dispatched stays.

Generated by Claude Code

Claim: PM loop · card thread · series card, cut 30 (cuts strictly serial; cuts 1–29 landed, the last PR #27029 68748c39bc)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_016SP1spj613tyGCgxoD1An6 (cuts 12–29's thread, reused)
Account: os-project-manager (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ybjm3h (the card thread's harness-pinned branch, restarted from origin/main after cut 29 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds). Lane cap: 4 for seats 1 and 2 (Leehom 「后续并发降到4」, 2026-10-27T22:39Z); this cut takes the free slot (lane at 3 of 4 at claim time).
File surface: packages/metadata-protocol/src/protocol.ts and one new seam module for the cut 29 report 6458845738's cut 30 proposal, one member on its own theme (the object-extender fold on a MetadataService body): foldObjectExtendersFromRegistry (protocol.ts:8901 on cbb3a1a1a5, private). engine is handed over as a getter; PLURAL_TO_SINGULAR stays imported in protocol.ts (other readers). Its try/catch guards the in-memory registry.foldObjectExtendersOnto call and moves with it unedited. Every caller keeps calling the class member (:7412, :9613, :11092, :11144, :11493, :11723). Estimated 60–90 changed lines. Also: other test files that read the moved body in protocol.ts by path (protocol.runtime-gate-stored-universe.test.ts names it only in a comment); the durability --list and the read-seam census re-measured (base 89; it must stay at 89 with an identical list); scripts/adr-anchors/** only if the moved member is the mechanism an entry paragraph describes. skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report). If the AST screen or the census trial does not hold, stop and report.
Container & model: S, mode:thread, model and effort as the thread was opened
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6458845738
Premise: holds (read 2026-10-28T04:42Z at origin/main cbb3a1a1a5: a private instance method at the line above)
Serial constraints cleared: cut 29 (#27029) merged before this claim. No open PR edits protocol.ts at claim time; re-check before pr_create, run git merge-tree against any that appears, and merge main once before pr_create.
Carried: findServedOverlayRow stays in the class (ACCEPT 6432438839). The liveness ledger's manifest.json and seed.json evidence pointers stay a spec-lane follow-up for the series close-out. Cut 25 trap: a comment-length change near an import can move a protocol.ts docblock onto a reused node offset, so tsc pastes it into an inferred spec type and breaks raw .d.ts identity by comments only (report 6448075845); compare comment-stripped prints first, then fix the comment length, never the .d.ts bar.

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-ybjm3h",
"pr": "#27129",
"session": "session_016SP1spj613tyGCgxoD1An6 — the card thread (claim 6460856054)",
"premise_still_valid": true,
"summary": "Cut 30, move-only, the one member as proposed: foldObjectExtendersFromRegistry (:8901, private, 18 body lines with comments), moved into the new protocol-object-extender-fold.ts (68 lines). ObjectExtenderFoldHost types engine as the class member, and engine is handed over as a getter. The try/catch around registry.foldObjectExtendersOnto moved with the body unedited. All 6 callers stay on the class method (:7412, :9613, :11092, :11144, :11493, :11723). Screen: no private-static read, no this.constructor read, 0 new Error(; read-seam census 89 at base and on the cut, with an identical --list. PLURAL_TO_SINGULAR stays imported (other readers), and the top level changes only by the new import. 94 changed lines (+76/-18; estimate 60-90). protocol.ts 29,425 -> 29,415. Commits: b542764 (move, amended from cc3ec04204, see deviations) on main cbb3a1a. Then three merges of main: 29cc169 (7 commits); 752f03c (12, bringing #27084's +95/-15 in protocol.ts, auto-merged); 307e5c9 (13). The second and third followed STALE TREE findings. The claim asked for one merge.",
"tests": "metadata-protocol suite (vitest --maxWorkers=2, json reporter, under os-verify-lock): base cbb3a1a and head b542764 both 21,761 tests (21,735 passed, 0 failed, 26 skipped), 280 files; 0 lost/added/changed. Merged 307e5c9 and main 6817bf1 both 21,775 (21,749 passed, 0 failed, 26 skipped, 281 files), per test identical. Base and main legs = src swapped tree-only and restored from HEAD under a trap. AST compare: 112 tokens, 0 differ, against base and again against main's protocol.ts on the merged tree. Negative controls, one-token in-memory swaps, each giving differ 1: singular !== 'object' -> 'view'; foldObjectExtendersOnto(name, body) -> (body, body). Class 304 members, 303 byte-identical, 1 stub keeps docblock+signature. Top level 263/263 byte-identical; head adds the module import. tsc --noEmit 0 at head and merged; eslint --no-inline-config packages/metadata-protocol 0, no output.",
"gates": ".d.ts (ruling 6348891160), one dependency tree, base cbb3a1a vs head b542764: RAW 7a0b7ca10b7be13b346d7034f854267d57a8efbc41350f12aab769c36ee78a88 (783,118 bytes) and NORMALISED cd4b7becaeffffd99b2e6db36c0147efbcaf17948bf2301a02cf203b45b9e504 at both ends. Merged 307e5c9 vs main 6817bf1 (full pnpm build 116/116): raw 9f7d69b1624e9398 (784,351 bytes) and normalised fd5431a235098745 at both. The same held for the second merge vs main 6845035, after #27084's protocol.ts change. Positive control (private dropped) -> 04fd085e8a03776c (normalised aa13275083654b7a), printing the member. index.js 5376c52e2c80abdd -> 5dd2faad4fb4d0c3 (index.cjs 84507a06aac8b045 -> e347dd6c9b78122c; merged: main aa69b0ce794c8221 -> 18aded551747cdaa); .call(host 0 -> 1; function decl 0 -> 1. Export tables 78 names sha 9f18a0177ac736ed everywhere. Hand gates exit 0 at both ends (base in a clean detached worktree at cbb3a1a). Identical: adr-anchors (1,898 decision letters, 60,136 citations), adr-symbol-anchors, system-context-census, tenant-audit-census, query-options-erasure-ratchet, filter-alias-parity, durability-degradation-log-level. DURABILITY --list identical after stripping [@:][0-9]+ (165 lines; 89 at base, head and merged). nul-bytes +1. engine-double-contract: seams 14009->13999 and 14034->14024; productionFiles 3,826 -> 3,828 (new file + gitignored registry.ts). Platform-checklist OK (31 judged, 0 lost). Governed: 0 of 2 paths, 94 lines. Derived on 307e5c9: 46/46 exit 0; --ran 46/46, 0 NOT-MEASURED, 0 UNRUN. That derivation still flagged STALE TREE on .github/workflows/lint.yml (main moved 5 more commits to 07d18e6, none in this package, merge-tree clean). Re-derived on the merge-tree of head with 07d18e6: no stale finding and the same 46 gate commands line for line, so there was no fourth merge. OPEN PRs at pr_create (26 open): none edits protocol.ts. #27084 had appeared editing protocol.ts but merged before pr_create and is in the second merge. #26937 (one test) and #26517 (CHANGELOG/package.json) touch this package and are merge-tree clean against head and main. CI at report time: just started.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "0 GitHub MCP calls (claim and open-PR list read by the REST API through gh api); 0 GitHub MCP writes; no subscribe_pr_activity",
"api_writes": "3 — git push of claude/project-thread-ybjm3h (new branch); relay pr_create (-> #27129, draft, assignee os-project-manager, label skip-changeset; read back 16,396 body bytes identical); this os-dev-report via post-stamped.mjs",
"line_budget": "94 changed lines (+76/-18), under the 3,000-line bar",
"files_changed": [
"packages/metadata-protocol/src/protocol.ts",
"packages/metadata-protocol/src/protocol-object-extender-fold.ts"
],
"deviations": [
"The cut 25 comment-offset trap fired on the first layout (cc3ec04204, never pushed). Raw .d.ts went to 701056df78aed858 (788,085 bytes, +4,967) and normalised to 522aaecdadbe5b51. tsc pasted the 'Zod schemas used to validate overlay items' docblock into an inferred spec type (ast?: unknown). The comment-stripped prints were identical (1583192e38f78f85). As the claim's carried note directs, the cut's own import comment was reworded 21 characters shorter and the move commit amended to b542764. Raw identity came back, and every head leg was re-run on b542764. Disclosed in the PR.",
"Three merges of main instead of the claim's one: the first two derivations reported STALE TREE (gate-source files changed on main while the chain ran). The third still named .github/workflows/lint.yml, so the gates were re-derived on the merge-tree with current main (same 46 commands, no stale finding) rather than merging a fourth time."
],
"open_questions": [],
"out_of_scope_findings": [
"Liveness ledger follow-up, carried forward (packages/spec/**, outside this card): manifest.json dependencies -> protocol.ts#resolveWritePackageScope (cut 19) and seed.json -> protocol.ts#applySeedBodies (cut 14). No row points at the cut 30 member.",
"The comment-offset trap is latent on main, now seen twice (cuts 25 and 30). Any protocol.ts edit that shifts offsets ahead of the :967 docblock can trip it. A cheap guard: a metadata-protocol build plus a raw .d.ts hash compare right after the move commit, before the long chain.",
"cut 31 proposal — one member, its own theme: readMetaItemFace, the disabled-package face around readMetaItem, into a new module (e.g. protocol-meta-item-face.ts). Line numbers on the merged head 307e5c9. readMetaItemFace (10702, private async, 11 body lines, return type inferred; it is private, so the .d.ts prints the name only): reads the engine field (getter) and readMetaItem (a closure, so that call stays on the class method). It also reads four module-level imports — isObjectOfDisabledPackage, objectPackageDisabledError, isItemOfDisabledPackage and noPendingDraftError — each with 2 other code references, so none leaves. Callers stay: getMetaItem (10653) and getMetaItemForExecution (10688). No private-static read, no this.constructor read, no try, no new Error( (the two errors come from imported factories). Census trial on cc3ec04204 (scratch move): 89 and an identical --list. No by-path reader names it; protocol.item-execution-read.test.ts names it in a comment and drives both faces. Estimated 70-100 changed lines. Watch: the inferred return type flows from the moved function through the stub, so compare the .d.ts as usual. Alternatives, both also census 89 identical with no by-path reader: (a) parseCommitItems (26460, private, 10 body lines, reads no member: a plain call; 2 callers 26558 and 26674); (b) storedRowKnownDatasources (6551, private async, 6 body lines; reads externalBindingDatasourceDefinition as a closure; 1 caller 22199). Class left after cut 30 (merged head): 304 members, 134 delegating stubs, 31 bodyless or fields, 139 with live bodies (12,716 body lines: 82 private with 3,440, 57 public with 9,276)."
]
}

Landed

PR #27129 merged at 2026-10-28T08:09Z by the merge queue as 17c34b8c69 on main (Part of #25467; ACCEPT 6463596470).

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-27129-*'`	0 refs
`origin/main` by content	`git cat-file -e origin/main:packages/metadata-protocol/src/protocol-object-extender-fold.ts`	present
Ancestry	`git merge-base --is-ancestor 17c34b8c69 origin/main`	holds

State: card stays open (Part of), pm:dispatched stays.

Generated by Claude Code

Claim: PM loop · card thread · series card, cut 31 (cuts strictly serial; cuts 1–30 landed, the last PR #27129 17c34b8c69)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_016SP1spj613tyGCgxoD1An6 (cuts 12–30's thread, reused)
Account: os-project-manager (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ybjm3h (the card thread's harness-pinned branch, restarted from origin/main after cut 30 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds). Lane cap: 4 for seats 1 and 2 (Leehom 「后续并发降到4」, 2026-10-27T22:39Z); this cut takes the slot cut 30 (#27129) freed.
File surface: packages/metadata-protocol/src/protocol.ts and one new seam module for the cut 30 report 6463239559's cut 31 proposal, one member on its own theme (the disabled-package face around readMetaItem): readMetaItemFace (protocol.ts:10702 on 1900c02cbe, private async, return type inferred). engine is handed over as a getter; readMetaItem is handed over as a closure, so that call stays on the class method. The four imported helpers it reads (isObjectOfDisabledPackage, objectPackageDisabledError, isItemOfDisabledPackage, noPendingDraftError) each keep other readers in protocol.ts, so they stay imported there and are imported again by the new module. Both callers keep calling the class member (getMetaItem :10653, getMetaItemForExecution :10688). Estimated 70–100 changed lines. Also: other test files that read the moved body in protocol.ts by path (protocol.item-execution-read.test.ts names it only in a comment); the durability --list and the read-seam census re-measured (base 89; it must stay at 89 with an identical list); scripts/adr-anchors/** only if the moved member is the mechanism an entry paragraph describes. The inferred return type flows through the stub, so compare the .d.ts as usual. skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report). If the AST screen or the census trial does not hold, stop and report.
Container & model: S, mode:thread, model and effort as the thread was opened
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6463239559
Premise: holds (read 2026-10-28T08:11Z at origin/main 1900c02cbe: a private async instance method at the line above)
Serial constraints cleared: cut 30 (#27129) merged before this claim. No open PR edits protocol.ts at claim time (27 open PRs read); re-check before pr_create, run git merge-tree against any that appears, and merge main once before pr_create.
Carried: findServedOverlayRow stays in the class (ACCEPT 6432438839). The liveness ledger's manifest.json and seed.json evidence pointers stay a spec-lane follow-up for the series close-out. Cut 25 trap: a comment-length change near an import can move a protocol.ts docblock onto a reused node offset, so tsc pastes it into an inferred spec type and breaks raw .d.ts identity by comments only (report 6448075845); compare comment-stripped prints first, then fix the comment length, never the .d.ts bar.

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-ybjm3h",
"pr": "#27181",
"session": "session_016SP1spj613tyGCgxoD1An6 — the card thread (claim 6464007535)",
"premise_still_valid": true,
"summary": "Cut 31, move-only, the one member as proposed: readMetaItemFace (:10702, private async, 11 body lines, return type inferred), moved into the new protocol-meta-item-face.ts (70 lines). MetaItemFaceHost types engine and readMetaItem as the class members. engine is handed over as a getter and readMetaItem as a closure, so that call stays on the class method, as the claim asked. Both callers stay on the class method: getMetaItem (:10653) and getMetaItemForExecution (:10688). The four disabled-package helpers (isObjectOfDisabledPackage, objectPackageDisabledError, isItemOfDisabledPackage, noPendingDraftError) stay where they are in protocol.ts; the module imports them from './protocol.js'. Screen: no private-static read, no this.constructor read, no try, 0 new Error(. Read-seam census 89 at base, on the cut and on the merged tree, with an identical --list. 92 changed lines (+80/-12; estimate 70-100). protocol.ts 29,495 -> 29,493. Commits: 0f3c00a (move) on main 1900c02, then one merge of main d12ae82 (11 commits up to 3346da2, none in this package).",
"tests": "metadata-protocol suite (vitest --maxWorkers=2, json reporter, under os-verify-lock): base 1900c02 and head 0f3c00a both 21,775 tests (21,749 passed, 0 failed, 26 skipped), 281 files; 0 lost/added/changed. Merged d12ae82 and main 3346da2 identical per test. AST compare: 181 tokens, 0 differ. Negative controls, one-token in-memory swaps, each giving differ 1: 'package' -> 'object'; state === 'draft' -> 'active'. Class 304 members, 303 byte-identical, 1 stub keeps docblock+signature. Top level 264 -> 265: 263 byte-identical, head adds the module import, and the one changed statement is noPendingDraftError gaining export (see deviations). tsc --noEmit 0 at head and merged; eslint --no-inline-config packages/metadata-protocol 0, no output.",
"gates": ".d.ts (ruling 6348891160), base 1900c02 vs head 0f3c00a: RAW 9f7d69b1624e93986442f4d5b558d8976671c791ec19d84dda5eb68b4249128b (784,351 bytes) and NORMALISED fd5431a235098745024b527517710c81a74652d9f8d4b842a691e9d3009207ef at both ends, so raw identity holds (the comment-offset trap did not fire; checked with a quick build right after the move commit). Merged d12ae82 vs main 3346da2: the same raw and normalised hashes at both. Positive control (private dropped) -> 74f2db843cbc8a66 (normalised b6f0bbbad4cbbe16), printing the member. index.js 18aded551747cdaa -> b4863907a762ba0b (index.cjs d859527bb8d3b7f1 -> d04d03f27652735c). Export tables 78 names sha 9f18a0177ac736ed everywhere: noPendingDraftError's in-place export is not re-exported by index.ts, so the published surface is unchanged. Hand gates exit 0 at both ends (base in a clean detached worktree at 1900c02). Identical: adr-anchors (1,900 decision letters, 60,175 citations), adr-symbol-anchors, system-context-census, tenant-audit-census, query-options-erasure-ratchet, filter-alias-parity, durability-degradation-log-level. DURABILITY --list identical after stripping [@:][0-9]+ (165 lines; 89 at base, head and merged). nul-bytes +1. engine-double-contract: seams 13999->13997 and 14024->14022; productionFiles 3,832 -> 3,834. Platform-checklist OK (31 judged, 0 lost). Governed: 0 of 2 paths. Derived on d12ae82: 46/46 exit 0; --ran 46/46, 0 NOT-MEASURED, 0 UNRUN, no STALE TREE. OPEN PRs at pr_create (21 open): none edits protocol.ts. #26937 (one test) and #26517 (CHANGELOG/package.json) touch this package and are merge-tree clean against head and main. main has since moved 9 commits to 72629f3, none in this package. CI at report time: just started.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "0 GitHub MCP calls (claim and open-PR list read by the REST API through gh api); 0 GitHub MCP writes; no subscribe_pr_activity",
"api_writes": "3 — git push of claude/project-thread-ybjm3h; relay pr_create (-> #27181, draft, assignee os-project-manager, label skip-changeset; read back 15,969 body bytes identical); this os-dev-report via post-stamped.mjs",
"line_budget": "92 changed lines (+80/-12), under the 3,000-line bar",
"files_changed": [
"packages/metadata-protocol/src/protocol.ts",
"packages/metadata-protocol/src/protocol-meta-item-face.ts"
],
"deviations": [
"The claim says the four disabled-package helpers 'stay imported in protocol.ts'. Three of them are imports there, but noPendingDraftError is protocol.ts's own non-exported module-level function. For the moved body to call it, it gained export in place (precedent: addressPackages in cut 16, withDeclaredPageTypeDefault in cut 23). Its body is unedited; index.ts names exports one by one, so the export table (78 names) and the .d.ts are unchanged. This is the only top-level statement that differs."
],
"open_questions": [],
"out_of_scope_findings": [
"Liveness ledger follow-up, carried forward (packages/spec/**, outside this card): manifest.json dependencies -> protocol.ts#resolveWritePackageScope (cut 19) and seed.json -> protocol.ts#applySeedBodies (cut 14). No row points at the cut 31 member.",
"cut 32 proposal — one member: parseCommitItems (line 26460 on 0f3c00a, private, 10 body lines) into a new module (e.g. protocol-commit-items.ts). It reads no class member, so the stub is a plain function call with no host. 2 callers stay: 26558 and 26674. No private-static read, no this.constructor read. Census trial on 0f3c00a (scratch move): 89 and an identical --list. No by-path reader names it. Estimated 40-70 changed lines. Alternatives, both also census 89 identical with no by-path reader: (a) storedRowKnownDatasources (6551, private async, 6 body lines; reads externalBindingDatasourceDefinition as a closure; 1 caller 22199); (b) the pair storedRowKnownDatasources + parseCommitItems in one cut (trialled together: 89, identical list). Class left after cut 31 (merged head): 304 members, 135 delegating stubs, 31 bodyless or fields, 138 with live bodies (12,705 body lines: 81 private with 3,429, 57 public with 9,276)."
]
}

Landed

PR #27181 merged at 2026-10-28T10:16Z by the merge queue as 9b242df34f on main (Part of #25467; ACCEPT 6465921904).

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-27181-*'`	0 refs
`origin/main` by content	`git cat-file -e origin/main:packages/metadata-protocol/src/protocol-meta-item-face.ts`	present
Ancestry	`git merge-base --is-ancestor 9b242df34f origin/main`	holds

State: card stays open (Part of), pm:dispatched stays.

Generated by Claude Code

Claim: PM loop · card thread · series card, cut 32 (cuts strictly serial; cuts 1–31 landed, the last PR #27181 9b242df34f)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_016SP1spj613tyGCgxoD1An6 (cuts 12–31's thread, reused)
Account: os-project-manager (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ybjm3h (the card thread's harness-pinned branch, restarted from origin/main after cut 31 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds). Lane cap: 2 for seats 1 and 2 (Leehom 「当前任务处理完，后续并发降到2」, 2026-10-28T09:40Z); this cut takes the slot cut 31 (#27181) freed (lane at 1 of 2 at claim time: seat 2's #27076).
File surface: packages/metadata-protocol/src/protocol.ts and one new seam module for the cut 31 report 6465513012's cut 32 proposal, one member on its own theme (parsing a stored commit row's items column): parseCommitItems (protocol.ts:26458 on 9b242df34f, private, explicit CommitPlanItem[] return type). It reads no class member, so the stub is a plain call with no host. Its try/catch guards JSON.parse and moves with it unedited. CommitPlanItem stays imported in protocol.ts if other readers keep it. Both callers keep calling the class member (:26556, :26672). Estimated 40–70 changed lines. Also: other test files that read the moved body in protocol.ts by path; the durability --list and the read-seam census re-measured (base 89; it must stay at 89 with an identical list); scripts/adr-anchors/** only if the moved member is the mechanism an entry paragraph describes. skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report). If the AST screen or the census trial does not hold, stop and report.
Container & model: S, mode:thread, model and effort as the thread was opened
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6465513012
Premise: holds (read 2026-10-28T10:18Z at origin/main 9b242df34f: a private instance method at the line above)
Serial constraints cleared: cut 31 (#27181) merged before this claim. No open PR edits protocol.ts at claim time; re-check before pr_create, run git merge-tree against any that appears, and merge main once before pr_create.
Carried: findServedOverlayRow stays in the class (ACCEPT 6432438839). The liveness ledger's manifest.json and seed.json evidence pointers stay a spec-lane follow-up for the series close-out. Cut 25 trap: a comment-length change near an import can move a protocol.ts docblock onto a reused node offset, so tsc pastes it into an inferred spec type and breaks raw .d.ts identity by comments only (report 6448075845); compare comment-stripped prints first, then fix the comment length, never the .d.ts bar. Cut 31 precedent: a protocol.ts-local helper the moved body needs may gain export in place when index.ts does not re-export it (disclose it).

Claim held · cut 32 · `domain:server` seat 1 · 2026-10-28T10:19Z

Claim 6466394180 (cut 32, parseCommitItems) is held, not started. My lane count at claim time was wrong: seat 2 still had three card threads developing (#27111, #27076, #27090), so the server lane was over Leehom's cap 「当前任务处理完，后续并发降到2」 (2026-10-28T09:40Z). The card thread has been told to stop before any edit. Cut 32 resumes on this same claim once the lane is under 2; nothing else about the claim changes.

Generated by Claude Code

Claim resumed · cut 32 · `domain:server` seat 1 · 2026-10-28T10:33Z

Claim 6466394180 (cut 32, parseCommitItems) resumes on the same terms. Seat 2 reports one card developing (#27111). #27076 is parked pm:blocked, and #27090 has handed back as PR #27204, in review. With this cut the server lane is at 2 of 2 under Leehom's cap 「当前任务处理完，后续并发降到2」 (2026-10-28T09:40Z).

Generated by Claude Code

Claim parked · cut 32 · `domain:server` seat 1 · 2026-10-28T10:34Z

Claim 6466394180 (cut 32, parseCommitItems) is parked, not started. Leehom said 「当前任务处理完，合并后就下班」 (2026-10-28T10:34Z), so no new cut starts today. The card thread was told to stop before any edit. Cut 32 resumes on this claim in the next working session; re-read origin/main and the open protocol.ts PRs first.

Generated by Claude Code

Release: series card #25467, cut 32 (parseCommitItems), self-released by the holder · domain:server seat 1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-28T11:52Z

Provenance: claim 6466394180 (cut 32), park note on this card (2026-10-28T10:35Z), and Leehom 「已认领、还没开工的应该放回队列」 (2026-10-28T11:52Z).
Produce: none. There are no edits, no commits and no PR. The card thread reset its local branch to origin/main and stopped.
Resume-from: none. A new claim starts cut 32 fresh from origin/main. The cut 31 report 6465513012 carries the proposal (parseCommitItems alone; alternatives storedRowKnownDatasources, or the two together). Cuts 1–31 have landed, the last as PR #27181 9b242df34f.

pm:dispatched → pm:queue, assignee cleared.

Generated by Claude Code

Navigation Menu

Repository navigation

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

90 remaining items

Landed

Landed

Landed

Claim held · cut 32 · `domain:server` seat 1 · 2026-10-28T10:19Z

Claim resumed · cut 32 · `domain:server` seat 1 · 2026-10-28T10:33Z

Claim parked · cut 32 · `domain:server` seat 1 · 2026-10-28T10:34Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467

Description

Measured (on origin/main b2c0752900, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

90 remaining items

objectstack-fleet commented on Oct 28, 2026

Landed

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

Landed

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

Landed

objectstack-fleet commented on Oct 28, 2026

objectstack-fleet commented on Oct 28, 2026

Claim held · cut 32 · domain:server seat 1 · 2026-10-28T10:19Z

objectstack-fleet commented on Oct 28, 2026

Claim resumed · cut 32 · domain:server seat 1 · 2026-10-28T10:33Z

objectstack-fleet commented on Oct 28, 2026

Claim parked · cut 32 · domain:server seat 1 · 2026-10-28T10:34Z

objectstack-fleet commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

Claim held · cut 32 · `domain:server` seat 1 · 2026-10-28T10:19Z

Claim resumed · cut 32 · `domain:server` seat 1 · 2026-10-28T10:33Z

Claim parked · cut 32 · `domain:server` seat 1 · 2026-10-28T10:34Z