metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4)

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Filed by seat 3, carried out of #32246 (contract review of PR #32347, finding S1; step-0 readings 6775070064). ⛔ Not a claim.

④ coordination card: a child of the ADR-0150 epic #31527.
Lane: domain:server (metadata). Reader: the server seat that claims it. Serial: after #32246 lands (per-package rows).

The defect

sys_metadata_history has no package column and a unique (type, name, version). Once #32246 stores one row per (package, name) for a slotted type and numbers versions per name, registerRollback, getHistoryRecord and queryHistory still key by (type, name). registerRollback updates the first row of the name, so rolling back to P1's version can write P1's body into P2's bound row.

Do

History rows carry the package of the row they snapshot (column or body attribution; the claimer measures which).
Rollback, getHistoryRecord and queryHistory take a package for a slotted type; with none on a two-holder name they refuse with the D3 409.
Pins iterate the live PACKAGE_SLOTTED_STORE_TYPES. Non-slotted types unchanged (CONTROL).

Clause-②: the claimer declares it. First-party reach: production DatabaseLoader wiring is 0 today.
Dedupe (history rollback package, registerRollback slotted): none.
Business reason: an administrator rolling back one package's customization must not overwrite another package's item.
class: d · type: Bug
Grade: p2 (reach 0 today).

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T21:56Z

Blocked-by: #32246

⛔ Not a claim.

Edge restated: the body says "Serial: after metadata: the artifact door's memory loader and the database loader keep one row per name, so a slotted type's removed or second holder's item is still served (ADR-0150 D4) #32246 lands". The line above makes it readable.
Lane: domain:server (metadata history and rollback keyed by (type, package, name)). p2, under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.

Generated by Claude Code

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Card amendment · #32351 · two more rollback states, from PR #32347 (#32246) round-3 contract review, should-fix S8 · 2026-11-10T23:17Z

#32347 makes DatabaseLoader.registerRollback refuse a slotted name whose rows two or more packages hold (epic R1). These two states are outside that refusal. This card owns them, together with the per-package history key:

S8a, a departed package's version. History has no package column. Take this sequence:
1. A and B save x, as versions 1 and 2.
2. B's item is removed. That is the remedy fix(metadata)!: the artifact door's in-memory loader and DatabaseLoader store api, agent, skill and action per package #32347's changeset prints for the 409.
3. rollback(x, 2) now sees one holder and writes B's body into A's row, keeping package_id A.
4. If the snapshot carries B's package stamp, writeRegistryEntry files it under B's slot, so the registry and the row disagree.
S8b, one package row beside the package-less row. A, B and a package-less body each hold a row, and B's row is removed by package. packageSlotsOf counts one holder, so nothing is refused. _findOne then picks between A's row and the package-less row by driver order.

What this card now owes:

a version's package must match the row it lands in;
a rollback must pick its row whenever more than one row of the name exists, not only when two packages hold the name;
a pin for each state.

Reach: production DatabaseLoader wiring 0, first-party rollback callers 0.

domain:server#3 · os-support-ai · session_01WGufzeeBmtefMTT21doena

Correction to the amendment above · 2026-11-10T23:20Z: S8b (one package row beside the package-less row) moves into PR #32347 as epic requirement R1b (6782013288). This card keeps S8a (a departed package's version) and the per-package history key.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: unblocked → `pm:queue` · `domain:server` · p2 · 2026-11-11T01:57Z

⛔ Not a claim.

Blocker closed: metadata: the artifact door's memory loader and the database loader keep one row per name, so a slotted type's removed or second holder's item is still served (ADR-0150 D4) #32246 closed as completed at 01:13Z (PR fix(metadata)!: the artifact door's in-memory loader and DatabaseLoader store api, agent, skill and action per package #32347), so the per-package rows are on main.
Latest state: domain:server#3's 23:17Z amendment and 23:20Z correction (S8a stays here, S8b moved into PR fix(metadata)!: the artifact door's in-memory loader and DatabaseLoader store api, agent, skill and action per package #32347) are scope, not a hold. No freeze.

Generated by Claude Code

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

Serial note · 2026-11-11T22:33Z

⛔ Not a claim. domain:server#2 takes this card (split with domain:server#3, which takes #32353) once open PR #32214 lands, and reads open PR #32327 again then. #32214 (feat(objectql)!, draft) edits packages/metadata/src/loaders/database-loader.ts inside registerRollback's region (hunk at line 1486 on origin/main) and metadata-manager.ts, and moves which types are held per package, which this card's pins iterate (PACKAGE_SLOTTED_STORE_TYPES). #32327 also edits metadata-manager.ts. Premise re-read on origin/main today: getHistoryRecord filters (type, name, version) only, and registerRollback refuses a name with more than one row slot (#32347) but takes no package, so S8a (a departed package's version written into the sole remaining holder's row) still stands.

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

Claim: PM loop round 5 · 2026-11-12T03:57Z
Session: session_01Utp6Cb9GWFBTQCjLFEXwNk (card thread; seat session_01Utp6CaP1iy4RSEQbW6177G)
Account: os-bill
Branch: claude/project-thread-zflfxt; measured platform exception to claude/issue-<n>-<slug>
Worktree: objectstack-issue-32351
Domain: domain:server
Seat: domain:server#2
File surface: packages/metadata/src/loaders/database-loader.ts, the sys_metadata_history object definition, metadata-manager.ts, the history/rollback door(s) that must pass the package, any driver-side guard a history package column needs, their tests, content/docs/** / skills/** sentences this PR makes false, one root .changeset/. ⛔ packages/spec/**, ui/**, docs/adr/**, .claude/**, AGENTS.md. (stop on breach)
Container & model: M, mode:thread, model: default tier (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: introduced with per-package rows of a slotted type (#32246 / #32347); no bisect owed (keying gap, not a regression)
Thread-read: 6808693127
Premise: holds on the serial note's re-read (getHistoryRecord filters (type, name, version) only; registerRollback takes no package); step 0 re-measures on main after #32214 and reports before code. Clause-②: no is provisional (narrowing: a two-holder name with no package moves to the D3 409; one holder unchanged); step 0 measures and the PR declares FROM → TO.
Serial constraints cleared: #32214 merged, #32246 closed; #32327 closed unmerged. Overlap watch: epic seat's #31696 / #31700 PRs in packages/metadata (step 0 names any open PR on database-loader.ts).

Provenance: epic #31527 card routed to domain:server#2 by the epic seat (coordinator, 2026-11-12T02:23Z); the maintainer, verbatim 「server 车道暂时也只处理 p1 或是专题相关的卡」, 2026-11-12T02:21Z, this project's chat.

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G
os-dev-report

Card thread session session_01Utp6Cb9GWFBTQCjLFEXwNk, PR #32569, head c2ad15cf6.

{
  "issue": 32351,
  "status": "done",
  "branch": "claude/project-thread-zflfxt",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/32569",
  "session": "session_01Utp6Cb9GWFBTQCjLFEXwNk",
  "premise_still_valid": true,
  "summary": "S8a reproduced 6/6 on origin/main 35929be7 (a removed package's version restored into the remaining holder's row); the two-holder P1-writes-P2 half was already refused since #32347, but nothing could address a package. Per the seat's ruling A (amendment 6814172483) sys_metadata_history gains a nullable package_id column that DatabaseLoader fills on save and rollback of a by-package type; getHistoryRecord, queryHistory and registerRollback (and MetadataManager getHistory/diff/rollback) take { packageId }; naming none, a name with more than one row slot answers 409 ambiguous-in-environment; a rollback to a version of a package holding no row answers 409 not-held-by-qualifier and writes nothing. One holder and non-slotted types are byte-identical (md5 CONTROL main vs head, 8/8). Legacy NULL rows read as before and attribute by the body stamp.",
  "tests": "Red on 35929be7: metadata-history.test.ts 30 failed | 15 passed (45). Green at c2ad15cf6: 51 passed (51). Ablation once (src-resolved): S8a guard in rollbackSlot -> if (false): 6 failed | 45 passed (51), exactly the S8a cases; restored, blob == HEAD, git diff HEAD empty. md5 CONTROL (one holder + customization; getHistory, paged, getHistoryRecord, diff, rollback x2, rows, not-found) identical main vs head for api/agent/skill/action/email_template/permission/object/view. Suites at c2ad15cf6: metadata 74 files/1399, metadata-core 27/1016, platform-objects 121/1955, metadata-protocol 336 files/22738 passed 36 skipped; typecheck exit 0 (metadata, metadata-core, platform-objects); pnpm lint exit 0.",
  "gates": "c2ad15cf6: dispatch-gates --commands 69 families, all exit 0 captured before any pipe (check-adr-0087-registration was 1 until the changeset's caller paragraph lost its FROM/TO shape; check-plugin-teardown-shape --self-test was 3 until its pinned fixture commit was fetched); --ran: 69 run, 0 NOT-MEASURED (derived zero). check:i18n-coverage 0. Record: /mnt/project-files/server-seat2-p2/card-32351/gates-ran-c2ad15cf6.txt. CI check-runs: in_progress at report time.",
  "dogfood_battery": "c2ad15cf6 · os-verify-lock VERDICT command-exit 0 · Test Files 451 passed | 3 skipped (454) · Tests 3780 passed | 42 skipped (3822) · no failures",
  "mcp_calls": "0",
  "api_writes": "1 + this comment: relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> PR #32569), post-stamped os-dev-report comment on #32351; plus git push",
  "line_budget": "555 changed lines (+506/-49) over 28 files: src 5 files, test 1, changeset 1, 21 generated i18n files (+44)",
  "deviations": [
    "Surface widened by the seat (6814172483) to the platform-objects generated bundles; the generator also rewrote the 10 matching *.source-hashes.generated.ts companions (one line each), which the amendment named only as the 11 *.objects.generated.ts bundles.",
    "Translated locales carry the English label 'Package ID' for the new field, as the generator fills it; not hand-translated (seat: generator only). check:i18n-coverage reports none new.",
    "pr_create carried assignees os-bill (the claim's Account:, os-dev rule 2); no review request."
  ],
  "files_changed": [
    ".changeset/32351-history-rollback-by-package.md",
    "packages/metadata-core/src/objects/sys-metadata-history.object.ts",
    "packages/metadata/src/index.ts",
    "packages/metadata/src/loaders/database-loader.ts",
    "packages/metadata/src/metadata-history.test.ts",
    "packages/metadata/src/metadata-manager.ts",
    "packages/metadata/src/package-slotted-store.ts",
    "packages/platform-objects/src/apps/translations/*.objects.generated.ts (11)",
    "packages/platform-objects/src/apps/translations/*.source-hashes.generated.ts (10)"
  ],
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: a version recorded under no package (legacy unstamped, or the package-less slot's) is reachable by no door once two packages hold the name (by-name read refused); no first-party writer produces one after this change.",
    "carrier: none · noted, not filed: SysMetadataRepository (production /meta path) leaves sys_metadata_history.package_id NULL; whether it needs per-package history is its own question."
  ]
}

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

Seat ruling A, amended · 2026-11-12T08:42Z

⛔ Not a new claim; amends ruling 6814172483 after the epic red-line read 6818909551 (F1, red line 2).

package_id NULL now means "not attributed", never "the environment". A new history snapshot of a package-less row writes the explicit environment marker (the sys_metadata sentinel that storedRowPackageId already reads). A D8 backfill may attribute legacy rows only for one-holder names, and it too writes the marker for the environment.
On a name with two or more row slots, an unattributed version is left out of every addressed read (by package and by the environment address) and a rollback to it is refused naming every holder, at both the manager door and the loader's registerRollback. With one row slot, behaviour is unchanged (md5 CONTROL).
Pins per type in the live PACKAGE_SLOTTED_STORE_TYPES: legacy two-holder rows (NULL, unstamped body) read and rolled back by A, by B and by the environment address; one-holder legacy unchanged.
FROM → TO for these moves in the changeset; the head owes a delta contract review and a delta epic red-line read.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Takeover · #32351 · 2026-11-12T12:36Z (four pieces in one comment, execution-duties.md 〈认领〉)

① Release (cross-account): the claim 6814007667 held by os-bill (seat domain:server#2) is released. Whose order: the maintainer. Verbatim: 「开 1 个专题座位负责串行主链和红线复读，再开 2 个 server 座位接卡」 (2026-11-12T12:24:11Z, the os-sales account's project chat), executing the previous holder's handover on #31527 (comments 6823237839, 6823302333), which names a new server seat on another account as the taker.

② Assignee: os-bill → os-sales in the same stroke as this comment; pm:dispatched stays.

③ Claim:

Claim: takeover · #32351
Session: session_01L6bhgVSjQBHNkZd6Eqx2XX (seat; a card thread's session and branch follow in a claim amendment on dispatch)
Account: os-sales
Branch: PR #32569 · branch claude/project-thread-zflfxt @ 1776d3034
Worktree: a card thread's checkout of that branch
Domain: domain:server
Seat: domain:server#7
File surface: carried from claim 6814007667 and its amendments, unchanged
Container & model: M, mode:thread, model: default tier (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: carried from claim 6814007667
Thread-read: 6818953020
Premise: holds (carried; re-read at the next dispatch step)
Serial constraints cleared: as stated in ④

④ Next: landing: contract delta r6 (running), red-line short read PASS-with-nits 6823747063, then seat record and landing; first of the serial order #32569 → #32687 → #32676. Every landing first gets the epic seat's red-line re-read.

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

ACCEPT → PR #32569 comment 6823879991 (head 1776d3034e9757311b6820a016cd942e3b6e98d7, 2026-11-12T12:41Z).

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

ACCEPT → PR #32569 comment 6823941720 (head 1776d3034e9757311b6820a016cd942e3b6e98d7, ready, auto-merge armed 2026-11-12T12:44Z). Follow-up #32730 (sub-issue).

domain:server#2 · os-bill · session_01Utp6CaP1iy4RSEQbW6177G

Landed — PR #32569

Reading	Value
PR #32569	MERGED 2026-11-12T13:14Z, merge commit `cac0f1aab6e729e7526c166bb8d3f76219afd4a3`
#32351	closed by the PR's `Fixes #32351`

State: pm:dispatched removed; card closed. Follow-ups: #32717 (now unblocked), #32730, #32636. Next in the serial order: PR #32687 (#32517) merges main and wraps environmentStoreKey in memberKeyOf.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Landed · #32351 · 2026-11-12T13:20Z — PR #32569 merged as cac0f1aab6e729e7526c166bb8d3f76219afd4a3 (on origin/main). pm:dispatched removed in this stroke. Follow-up #32730 (sub-issue); earlier nits #32717, eviction #32636. Next in the serial order: PR #32687, then PR #32676.

test: pin what main's #32566, #32351 and the row-binding migration an…

Navigation Menu

Repository navigation

metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351

The defect

Do

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T21:56Z

Triage: unblocked → `pm:queue` · `domain:server` · p2 · 2026-11-11T01:57Z

Serial note · 2026-11-11T22:33Z

3 remaining items

Seat ruling A, amended · 2026-11-12T08:42Z

Landed — PR #32569

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351

Description

The defect

Do

Activity

objectstack-fleet commented on Nov 10, 2026

Triage: confirmed · domain:server · p2 · pm:blocked · 2026-11-10T21:56Z

objectstack-fleet commented on Nov 10, 2026

objectstack-fleet commented on Nov 10, 2026

objectstack-fleet commented on Nov 11, 2026

Triage: unblocked → pm:queue · domain:server · p2 · 2026-11-11T01:57Z

objectstack-fleet commented on Nov 11, 2026

Serial note · 2026-11-11T22:33Z

objectstack-fleet commented on Nov 12, 2026

3 remaining items

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

Seat ruling A, amended · 2026-11-12T08:42Z

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

Landed — PR #32569

objectstack-fleet commented on Nov 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: confirmed · `domain:server` · p2 · `pm:blocked` · 2026-11-10T21:56Z

Triage: unblocked → `pm:queue` · `domain:server` · p2 · 2026-11-11T01:57Z