rest + service-analytics: the dataset query door judges admission before it resolves, and the dataset tools run a holder's effective (overlay-first) item (ADR-0150 D3, ADR-0149 D2)

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Filed by seat 3, split out of #32183 at its step 0 (readings 6773035227, tree de141e32; seat ruling on #32183). ⛔ Not a claim.
Ruling-ref: epic ruling 6766102988 point 1 (last sentence) and epic ruling (b) on #32098, carried as the #32183 card notes 6767831853 and 6767803831. The two limbs move to this card because they are a different class from #32183's disabled-holder set (an ADR-0149 D2 visibility order, and one holder's row choice), and they sit outside its file surface.

④ coordination card: a child of the ADR-0150 epic #31527.

Epic: ADR-0150 (#31527). Lane: domain:server (rest analytics routes, service-analytics dataset tools). Reader: the server seat that claims it.
Serial: after #32183 lands (it changes the holder set the dataset door reads through getMetaItem).

Limb 1: the REST dataset query door's order (from 6767831853)

POST /analytics/dataset/query (packages/rest/src/analytics-routes.ts) resolves the name through the registry first and reaches admission only inside queryDataset. A caller admitted to neither holder gets a 409 naming both packages. MCP query_dataset admits first and then applies D3 over the admitted holders (#32098, ADR-0149 D2). This breaks no red line: the 409 names every candidate and picks nothing.

Limb 2: one holder's effective item on the served list (from 6767803831)

MCP query_dataset reads the served list. On the stdio fallback one holder can have two listed rows: a bare-slot overlay beside the composite, both stamped with one _packageId. The tool keeps the first parsed row, which is the list's order. The registry's getPackageScopedItem serves the bound bare-slot overlay first, so a customized dataset can run its uncustomized base on that host.

Do

Decide and build the REST door's order. Either judge admission (admitDatasetCatalogEntry) before resolving, as MCP query_dataset does, or record why not. If it judges first: a caller admitted to no holder gets NOT_FOUND, byte-equal to a missing name; admitted to exactly one gets that one; a refusal names only the admitted holders. Declare each moved answer FROM → TO, and pin the hidden holder as absent from every answer.
One holder, one effective item. When a served-list door takes one holder's item, it takes the holder's effective item (overlay first), the same one the registry serves. Pin: a customized dataset on the stdio fallback runs its overlay.
Census every other served-list door that picks one row per holder (dataset, skill prompts/get, the agent roster) for the same first-row choice, and record each.

Clause-②: the claimer declares it. Limb 1 moves 409 → 404/200 for callers admitted to fewer holders (a widening for some, and a visibility change the epic seat red-line reads). Limb 2 moves which body runs.
Dedupe (open and closed: dataset query admission order, query_dataset overlay first parsed row, admitDatasetCatalogEntry): only #32183 (where the limbs were carried), #32072 and #31589 (closed, the work these limbs follow).
Business reason: a caller who may not see a dataset should not learn its package from a refusal, and an administrator's customization of a dataset should be what runs on every host.
Epic red-line review before landing.
class: d · type: Feature
Grade: p2 (no red line broken today; first-party reach 0, since no first-party name has two holders).

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T17:06Z

Blocked-by: #32183

⛔ Not a claim.

Edge restated: the body says "Serial: after objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183 lands", which the sweep does not read. The line above makes it readable. objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183 is open, and now carries pm:blocking.
Lane: domain:server (rest and service-analytics). The dataset door resolves before it judges admission. p2, under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.

Generated by Claude Code

epic:#31527#1 · os-support-ai · session_01WGufzj7TEH65FDimZdn1H3

Scope note for this card (from the epic red-line read of #32337 / #32310)

#32337 adds ?callerPackage= to the dataset query doors (single and batch) and to /meta/dataset. The arm resolves the name by D3 for the named reader before admission, the same order ?package= and the bare read have on this door today.

When this card moves the REST dataset query door to admission-first (ruling 6766102988), the caller arm must move too:

its D3 candidates are the holders the caller is admitted to;
none admitted answers NOT_FOUND, byte-equal to a missing name;
two or more admitted answer 409 naming only those;
exactly one admitted answers that one.

Pin it on the caller arm as well as on the bare read and ?package=.

Generated by Claude Code

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim: PM loop round 7 · #32292 · 2026-11-12T07:32Z · enhancement (p2, epic #31527 wave 2)
Session: session_01Utp6CaAUev5V62cLHhQwBi (seat); dev = card thread session_01Utp6CXLtecZQf5TdctzHsR
Account: os-bill
Branch: claude/project-thread-elxrlt (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-32292
Domain: domain:server
Seat: domain:server#3
File surface: packages/rest/src/** (analytics routes), the service-analytics dataset tools, their tests, one changeset (stop on breach; packages/spec/**, docs/adr/**, .claude/** excluded)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: yes (expected; limb 1 moves 409 → 404/200 for some callers; limb 2 moves which body runs)
Metadata-protocol: none (expected; step 0 declares)
Responsibility: limb 1: POST /analytics/dataset/query judges admission before resolving; limb 2: dataset tools take a holder's effective (overlay-first) item; census of other one-row-per-holder served-list doors
Thread-read: 6781265442
Premise: measured on the blocker head at step 0 before any edit; premise_still_valid: false is a valid result once the blocker lands
Serial constraints cleared: Blocked by #32183 (PR #32497): work starts locally from claude/project-thread-phk4r9. Independent of #32501/#32354. Nothing is pushed until the blocker merges; then main is merged in (never rebase) and a draft PR opens. Blocked-by stays on the card until then. Epic red-line read before ACCEPT; needs_decision goes to the epic seat.
Label: pm:blocked → pm:dispatched (a live claim works it from the blocker's head; the Blocked-by: line in the body stays and still gates the push and the landing).

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim amendment: #32292 · 2026-11-12T07:43Z · seat ruling on step 0 (note /mnt/project-files/server-seat3-p2/card-32292/step0.md, measured on claude/project-thread-phk4r9 @ 6655b742, the PR #32497 head, real showcase plus two packages alpha/beta)

Limb 1 holds and is in scope. analytics-routes.ts:649 resolves through getMetaItem under D3 and refuses 409 before admission is asked at :726 (queryDataset). A caller admitted to neither holder gets 409 naming both. Fix as proposed. When the resolver refuses, read each candidate's effective item at its exact address and admit it with admitDatasetCatalogEntry:

none admitted: 404, byte-equal to a missing name;
exactly one admitted: run it;
otherwise: 409 naming only the admitted holders;
admission undetermined: 503 (fail closed).

Pin the hidden holder as absent from every answer.

Q1: A. Admission moves ahead only on the resolver's refusal arm. Single-holder answers do not move: the 403 for a caller not admitted to the one holder stays. B would turn every dashboard's 403 into 404, which this card does not ask for. Record that reason in the PR.

Q2: A. When the caller arm resolves to P itself or a closure item but admission refuses, today's answer stands. It never falls through to another package's item of the same name. That is the conservative rule (bind to no package, never guess).

Q3: A. Limb 2 is withdrawn as not reproduced, so premise_still_valid: false for limb 2. The protocol's merged list has one overlaid row per package. The stdio fallback lists 0 package dataset rows, and no host in the tree feeds two rows of one package. Record the census in the PR (dataset-tools.ts:272 and skill-prompts.ts:167/247 take the first row of the same merged list, so they have no reach; the agent roster mcp-server-runtime.ts:1032 does not pick), with no code change.

Moved answers: 409 naming both → 404 / 200 / 409 naming the admitted holders, for callers admitted to fewer holders (Clause-② yes, a widening and a visibility change). Metadata-protocol: none. File surface stays in packages/rest/src/** plus tests and one changeset. Ablate each negative pin once. Review: CONTRACT_REVIEW_TIER plus the epic red-line read.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Takeover · #32292 · 2026-11-12T12:40Z (four pieces in one comment, execution-duties.md 〈认领〉)

① Release (cross-account): the claim 6817615501 held by os-bill (seat domain:server#3) is released. Whose order: the maintainer. Verbatim: 「开 1 个专题座位负责串行主链和红线复读，再开 2 个 server 座位接卡」 (2026-11-12T12:24:11Z, the os-sales account's project chat), executing the previous holder's handover on #31527 (comments 6823237839, 6823302333), which names a new server seat on another account as the taker.

② Assignee: os-bill → os-sales in the same stroke as this comment; pm:dispatched stays.

③ Claim:

Claim: takeover · #32292
Session: session_01L6bhgVSjQBHNkZd6Eqx2XX (seat; a card thread's session and branch follow in a claim amendment on dispatch)
Account: os-sales
Branch: branch claude/project-thread-elxrlt @ 339584f66, no PR
Worktree: a card thread's checkout of that branch
Domain: domain:server
Seat: domain:server#7
File surface: carried from claim 6817615501 and its amendments, unchanged
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: yes (expected; limb 1 moves 409 → 404/200 for some callers; limb 2 moves which body runs)
Metadata-protocol: none (expected; step 0 declares)
Responsibility: carried from claim 6817615501
Thread-read: 6817809380
Premise: holds (carried; re-read at the next dispatch step)
Serial constraints cleared: as stated in ④

④ Next: waits on PR #32497; limb 1 only. Every landing first gets the epic seat's red-line re-read.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Un-parked · #32292 · 2026-11-12T13:37Z — the park above is withdrawn. The maintainer (Sales) corrected the release-line ruling 6824949405 in the os-sales project, verbatim: 「我也不着急发版，你已经开发完的分支，还是继续推进到合并」 (2026-11-12T13:30:34Z). A card whose work is developed and pushed continues to merge. pm:on-hold → pm:dispatched, assignee os-sales restored, in this stroke; the takeover claim stands. Still waits on PR #32497.

domain:server#7 · os-sales · session_01L6bhgVQtH5Sd8rivsRdDor
os-dev-report

{
  "issue": 32292,
  "status": "done",
  "branch": "claude/project-thread-elxrlt",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/32804",
  "session": "session_01L6bhgVQtH5Sd8rivsRdDor",
  "premise_still_valid": true,
  "summary": "Limb 1 only (limb 2 withdrawn by seat ruling 6817809380, Q3 = A; census in the PR body). Main 2f80f2897, which carries PR #32497 as 0763bf6ec, is merged in at 7499b616a with no rebase: all ten remerge-diff files are the blocker's and each merged blob equals origin/main's, so the delta over main is this card's four files (+539/-45). Head 890be0cd1 adds three pins the ruling still owed: one holder not admitted keeps queryDataset's 403 (Q1 = A), the caller arm's one closure item keeps its 403 and never falls through to a holder outside the closure (Q2 = A), and the caller arm's three-holder refusal names only the two admitted holders (epic scope note 6781265442). Clause-② yes (widening), Metadata-protocol none, as ruled.",
  "tests": "head 890be0cd1: the #32292 describe in packages/rest/src/analytics-routes.test.ts 14/14 green; pnpm --filter @objectstack/rest test exit 0 (407 files, 8124 passed, 332 skipped); test:repo exit 0 (5 files, 300 passed, 23 skipped); typecheck exit 0. Ablation through scripts/ablation-replace.mjs, each leg proven on disk (anchor 1 to 0, blob moved) and restored (blob == HEAD, git diff HEAD empty): A0 refusal rethrown before the rule (main's door) 8 red / 6 green; A1 narrowed refusal keeps every candidate 3 red; A2 503 arm removed 1 red; A3 one-admitted ambiguity not picked 3 red; every control green on every leg. A fifth leg with origin/main's own analytics-routes.ts blob 8a88b63d gives the same 8 red / 6 green as A0, restored to 77cd4831 (HEAD). rest tests import the door from source, so no rebuild between legs.",
  "gates": "dispatch-gates --commands derived 65 for 4 paths; all 65 exit 0 on 890be0cd1, --ran reconciles 65 derived / 65 run / 0 NOT-MEASURED / 0 UNRUN. First pass had two exit 3 prerequisites, both rerun exit 0: check-plugin-teardown-shape --self-test after fetching its pinned fixture commit (shallow clone), check:dual-build-cjs-loads after a full pnpm build (119/119). ADR-0087 registration (--base origin/main, --self-test) and the changeset gates are in the 65. pnpm lint exit 0. CI on the PR: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and the arm is (widening)",
  "mcp_calls": "3 — mcp__github__issue_read (get, get_comments) and mcp__github__list_pull_requests, all reads; no write tool",
  "api_writes": "3 — relay pr_create (POST /pulls, POST /issues/32804/assignees) and this comment; plus two git pushes to the card branch (not REST)",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

Not done here, left to the seat: the reviewer request (relay pr_request_reviewers at the seat's hand-off), the contract review, the epic red-line read, ready and the queue.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Claim amendment · 2026-11-12T20:22Z — file surface of claim 6817615501 widened by one file: content/docs/data-modeling/analytics.mdx (its two-holder paragraph is made untrue by PR #32804, so the PR corrects it; os-dev rule: a sentence this change makes false is fixed in the same PR). Card thread session session_01L6bhgVQtH5Sd8rivsRdDor, branch claude/project-thread-elxrlt. Nothing else changes.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Landed · #32292 · 2026-11-12T21:55Z — PR #32804 (ACCEPT 6836377126) merged as 2fc3fce5bb7a54780288ff1a6dae1767bd96029c (on origin/main). pm:dispatched removed in this stroke. Follow-up #32826 (sub-issue, parked under ruling 6824949405 on #31527).

Merge origin/main into claude/project-thread-3jrz5i (landing merge)

test(#32501): pin the App pair dataset doors under plugin-wired admis…

docs(changeset): #32501 states the dataset doors per admission case o…

docs(changeset): #32501 the dataset doors' widenings meet the query's…

Navigation Menu

Repository navigation

rest + service-analytics: the dataset query door judges admission before it resolves, and the dataset tools run a holder's effective (overlay-first) item (ADR-0150 D3, ADR-0149 D2) #32292

Limb 1: the REST dataset query door's order (from 6767831853)

Limb 2: one holder's effective item on the served list (from 6767803831)

Do

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T17:06Z

5 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

rest + service-analytics: the dataset query door judges admission before it resolves, and the dataset tools run a holder's effective (overlay-first) item (ADR-0150 D3, ADR-0149 D2) #32292

Description

Limb 1: the REST dataset query door's order (from 6767831853)

Limb 2: one holder's effective item on the served list (from 6767803831)

Do

Activity

objectstack-fleet commented on Nov 10, 2026

Triage: confirmed · domain:server · p2 · pm:blocked · 2026-11-10T17:06Z

objectstack-fleet commented on Nov 10, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

5 remaining items

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T17:06Z