metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4)

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Child of the ADR-0150 epic #31527. Filed at the landing of #32214 (#31699 PR 1/3), following:

the epic red-line read 6792024828, item S1;
the dev's out-of-scope item (2) carried in hand-offs 6785463570 and 6790921204.

Where. overlaySlotBinding (metadata). #32214 makes its exact-read path honour a pair row's overrides.package. Its other readers, bundleMembersHeldBy and getEnvironmentScopedItem, still bind a pair row without reading overrides.package, by the dev's reading at 7136e339. The reach has NOT been measured.

Rulings.

6761802819 F2: when two pairs could own a row, refuse both. With exactly one pair, serve it to that pair. The base's own address keeps docs(adr): ADR-0146 amendment — only the paired <base>.custom declares an override; a dependent package adds under its own names (ruled A, withdraws rider 3) #28390 ruling A.
feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214 implements that ruling on the exact read.

Do.

Measure on main after feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214 lands. With two pairs X and Y of base A, and a pair row bound by overrides.package to X:
- what does bundleMembersHeldBy answer for X and for Y?
- what does getEnvironmentScopedItem answer?
Repeat with an unbound pair row.
If either reader binds the row to the wrong pair, or to both, make it read the binding the way the exact read now does.
Pins:
- bound to X → only X;
- unbound with two pairs → neither;
- unbound with one pair → that pair.
Ablate once.

Serial. After #32214 lands.

Clause-②: the claimer declares it after measuring. A reader that served a wrong pair and now does not is a narrowing.

Dedupe (overlaySlotBinding bundleMembersHeldBy, getEnvironmentScopedItem overrides.package): none found.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-11T09:58Z

Blocked-by: #32214

⛔ Not a claim.

Edge restated: the body says "Serial. After feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214 lands". PR feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214 is open.
Grade: p2 (ADR-0150 D4, the epic red-line read S1). Linked as a child of design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.

Generated by Claude Code

domain:server#5 · os-bill · session_01Utp6CX9R5BLZwgJDeivmA7

Claim: PM loop round 1
Session: session_01Utp6CbGpwJzMFhChu9a91Q (card thread; seat session session_01Utp6CX9R5BLZwgJDeivmA7)
Account: os-bill
Branch: claude/project-thread-3e08el
Worktree: objectstack-issue-32408
Domain: domain:server
Seat: domain:server#5
File surface: packages/metadata/src/{package-slotted-store.ts,metadata-manager.ts} + tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high (p2)
Clause-②: no (narrowing) — card: "A reader that served a wrong pair and now does not is a narrowing"; the dev confirms after measuring step 1
Metadata-protocol: narrowed (expected; dogfood battery and a contract review owed)
Responsibility: platform code in objectstack (packages/metadata*) produces the risk, the fix is a platform card · no platform path covers it today · reach: a host wiring a DatabaseLoader / the named door; first-party census per card body (expected 0)
Thread-read: 6792808340
Premise: holds (card body; the thread measures step 1 first on the start sha and reports premise_still_valid)
Serial constraints cleared: PR #32214 (lands first). Serial behind #32488 (uh82kc), #32458 (p4h8mg), #32459 (6dixl5); shares package-slotted-store.ts. Epic chain in flight: wqgmuu, du44hj, phk4r9; trial-merge before queue.
Start: develops locally from PR #32214's final head 27abd458a8f948315e70a1636d2a83055d6bf3ea; ⛔ no push until #32214 merges, then merge origin/main and push. Order: epic #31527 seat's dispatch, delegated to this seat. Epic red-line read owed by epic:#31527#1 before ACCEPT.

domain:server#5 · os-bill · session_01Utp6CX9R5BLZwgJDeivmA7

Claim amendment (claim 6812609395) · 2026-11-12T03:24Z

File surface: packages/objectql/src/registry.ts (overlaySlotBinding) + objectql tests. The card thread measured that the readers named on the card bind through objectql's registry, not packages/metadata; getEnvironmentScopedItem is not reached in any case.
Clause-②: yes — measured: one widening (a bare read of a name held inside one App: 409 → served) beside one narrowing (a later package carrying only a locale the App's pair overrode for X is refused as an addition to the App template; it was admitted). The epic seat's red-line read of both is pending.
Metadata-protocol: narrowed (measured).
Serial constraints: unchanged chain; the thread trial-merges claude/project-thread-wqgmuu, du44hj and phk4r9 for registry.ts overlap before the PR.

domain:server#5 · os-bill · session_01Utp6CbGpwJzMFhChu9a91Q
os-dev-report

{
  "issue": 32408,
  "status": "done",
  "branch": "claude/project-thread-3e08el",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/32557",
  "head": "ed0f2baa0d5ad4212ce73920ea2ec5670f731369",
  "session": "session_01Utp6CbGpwJzMFhChu9a91Q",
  "premise_still_valid": true,
  "summary": "Measured on 27abd458a8 (step 1): SchemaRegistry#overlaySlotBinding (packages/objectql/src/registry.ts, not packages/metadata) read a row stored in a customization pair by the pair's per-package base only (customizationBasePackageId), never through the App (isPairOf: one pair per App, shared by its packages) and never by overrides.package. So with two packages X, Y of App A holding a name, a pair row (declared X or not) bound to the pair itself, a third holder; with A holding, a row declaring X bound to A, and bundleMembersHeldBy counted its locale as A's. getEnvironmentScopedItem never served a pair row in any case: reach none. Fix: overlaySlotBinding asks a new pairRowBinding when some holder is a package the pair customizes, reading the row as the exact read's owner check (pairRowOnAddress) does: the declared holder when the pair customizes it; else the App whose own pair it is (#28390 ruling A); else the one owner; else no package; a declared non-owner binds to no package. One binding, four readers (packageScopedHoldersOf, bundleMembersHeldBy, getPackageScopedItem, getEnvironmentScopedItem). Epic seat 1 ruled the three moves stay in this PR with Clause-② yes (narrowing), Metadata-protocol narrowed; the bare-read widening is a corrected false 409, with a control pin for two real holders.",
  "clause_2": "yes (narrowing) — the bare-name gate now refuses, as an addition to the App's template naming the App, a package whose only locale is one the App's pair overrides for another package of the App (admitted before: the pair row counted as the App's member). First-party: 0.",
  "metadata_protocol": "narrowed",
  "moved_answers": [
    "bare-name gate, addition while the App's pair overrides that locale for X: admitted -> refused naming the App (narrowing)",
    "packageScopedHoldersOf with the App not holding: the pair counted as a holder -> never a holder",
    "bare read, one package of the App holding: 409 naming X and the pair -> the row / X's own (corrects a false 409; widening, ruled compliant)",
    "bare read and ?package=A refusals with two packages of the App holding: candidates X, Y, pair -> X, Y",
    "getPackageScopedItem(X), row declares X or X sole owner: X's shipped item -> the row (what ?package=X already served)",
    "getPackageScopedItem(pair): the row -> none (?package=pair unchanged)",
    "bundleMembersHeldBy, row declares X: counted as the App's or the pair's -> X's",
    "?package=A, row declares a non-holder: the row -> A's own item",
    "getEnvironmentScopedItem: unchanged (measured)"
  ],
  "tests": "packages/objectql/src/package-scoped-resolver.test.ts (shared harness), one describe, 9 cases: bound to X -> only X (X,Y hold; beside the App; as a bundle member), unbound with two -> neither, unbound with one -> that one, the gate narrowing, a declared non-holder, CONTROL ruling A, CONTROL two independent holders (epic seat 1's condition). Ablation once at c76886282 via scripts/ablation-replace.mjs (pairRowBinding call replaced by NOT_A_PAIR_ROW_OF_A_HOLDER): 7 failed / 69 passed of 76, both controls green; restored blob == HEAD 975c8f84f0cf, git diff HEAD empty. Protocol measurement (getMetaItem bare and ?package= of A, X, Y, pair; 9 cases) before/after: only rows 3, 4 and 8 of the PR table moved.",
  "gates": "At c76886282 after full install + build with declarations: dispatch-gates --commands on the 3 paths, 71 families, 71/71 exit 0; --ran on the same paths: 71 derived, 71 run, 0 NOT-MEASURED, 0 UNRUN (record: /mnt/project-files/server-seatC/card-32408/gates-ran-c76886282.txt). pnpm lint exit 0; objectql typecheck exit 0; objectql 12356/12356 (587 files); metadata-protocol 22738 passed / 36 skipped; dogfood battery 451 files passed / 3 skipped, 3780 tests passed / 42 skipped. Main then moved 11 commits (none in registry.ts or the harness): merged at ed0f2baa0, rebuilt the objectql closure, overlapping suites 222/222. check-governed-merges: 0 governed, 231 lines. dispatch-gates --tier: no path-derived mandate.",
  "dogfood_battery": "ran: 451 passed / 3 skipped files, 3780 passed / 42 skipped tests, on c76886282",
  "line_budget": "+228 / -3 over 3 files (231): registry.ts +62/-3, harness +142, changeset +24",
  "files_changed": ["packages/objectql/src/registry.ts", "packages/objectql/src/package-scoped-resolver.test.ts", ".changeset/32408-pair-row-binding-every-reader.md"],
  "trial_merges": "wqgmuu, du44hj, phk4r9: each merged with main first, then this delta, file by file: 0 conflicts in registry.ts and the harness; phk4r9's disabled-holder filter composes with this binding.",
  "deviations": [
    "Surface: objectql registry.ts, not packages/metadata (the order's estimate); the Claim's file surface was corrected by the seat (6813452518).",
    "Clause-② declared yes (narrowing), not the order's expected no (narrowing): the registry's public reads and the bare-name gate move; ruled correct by epic seat 1.",
    "The fix sits in overlaySlotBinding, so getPackageScopedItem and packageScopedHoldersOf move with the two readers the card named (the class sweep #32214's lessons ask for); each move is declared and pinned.",
    "check-commit-card-trailers over origin/main..HEAD flags only PR #32214's own history, which the branch carries because it started from that PR's final head (the order's start sha); none of this PR's commits is flagged.",
    "No assignee and no review request on the PR (order: relay pr_create, no MCP write); the session-context MCP assignee/reviewer step was skipped for that reason."
  ],
  "mcp_calls": "0 GitHub MCP calls (card and comments read through gh api GET); 1 subscribe_pr_activity on #32557 (session harness, not a GitHub write)",
  "api_writes": "2 — relay pr_create (run 43156163597, body read back identical 11895 bytes) and this report through post-stamped.mjs; plus 4 git pushes (not REST)",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "noted, not filed: a row whose overrides.package names a non-owner is off-door data (the save gate writes the declaration only where the base ships the item); it now binds to no package, declared in the PR. carrier: none"
  ]
}

Report taken 2026-11-12T04:40Z.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Claim amendment to this seat's takeover claim 6823795824 on #32408 · 2026-11-12T19:32Z:
Session: session_01L6bhgUJkevgE12tpg42pZA (card thread; seat session session_01L6bhgVaKJ9TPfXPRhdqx3e)
Branch: claude/project-thread-3e08el (PR #32557) if the maintainer allows the push to it; otherwise the thread's harness branch claude/project-thread-iv3vz6, started from 3e08el@075fb3188b5aec8cd9d572ef7f48516562ce23cb with origin/main merged in (never rebased), with a replacement draft PR that names #32557 and its review history; 3e08el is then left as pushed.
File surface (corrected; the takeover line copied the card's guess): packages/objectql/src/registry.ts (overlaySlotBinding, pairRowBinding) + objectql tests, as amendment 6813452518 measured; added: packages/spec/src/migrations/entries/semantic/18.pair-row-locale-addition-refused.ts (the ADR-0087 semantic entry the narrowing owes) and .changeset/ (the existing changeset and the entry's own). Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: xhigh (epic card; maintainer's effort rule, 2026-11-12 17:17Z).
Serial constraints: PR #32497 has merged (0763bf6ec), so the "waits on #32497" constraint is met; #32561 and #32552 wait on this card.
Everything else in the takeover claim stands.

domain:server#1 · os-sales · session_01L6bhgUJkevgE12tpg42pZA
os-dev-report

{
  "issue": 32408,
  "status": "done",
  "branch": "claude/project-thread-3e08el (PR #32557's branch, still at 075fb318 on the remote) — the final head e94a8de8f is pushed to claude/project-thread-iv3vz6 as a backup; it reaches 3e08el as a fast-forward once the maintainer allows that push (this container lets only iv3vz6 through). Never rebased, never force-pushed.",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/32557",
  "session": "session_01L6bhgUJkevgE12tpg42pZA",
  "premise_still_valid": true,
  "summary": "Landing round after #32497 merged: origin/main 2f80f2897 merged at 7bea2a2ae (clean, no rebase); overlaySlotBinding is still the only binding of a bare-slot row on the merged tree, and #32497's served filter applies after it inside packageScopedHoldersOf. The owed items are in: the changeset nit from review 6815340803 (conjunction restored, 'another shared pair'), the ADR-0087 semantic entry 18.pair-row-locale-addition-refused with its own spec patch changeset, and the jsdoc on pairRowBinding. Merging main surfaced two new moved answers (rows 10, 11: with every holder of the App disabled, the bare read and an addition's address withhold the pair row) and one new residual (3: one of two holders disabled, the registry binds the row to no package while ?package=X serves it), all declared in the changeset and pinned. The fresh PR body r2 is at /mnt/project-files/briefs/32408-pr-32557-body-r2.md for the seat to write through the relay.",
  "tests": "pnpm --filter @objectstack/objectql test: 589 files passed, 12609 tests passed. Two new pins in package-scoped-exact-qualifier.test.ts ([#32408, #32183] a row of the App's pair is bound over every holder...; ...bound to its one holder is that holder's...). Ablation on the final head e94a8de8f via scripts/ablation-replace.mjs: 'const paired = this.pairRowBinding(type, stamped, item, name, collection, composite);' replaced by 'const paired = NOT_A_PAIR_ROW_OF_A_HOLDER; // ABLATED #32408', anchor 1 to 0, blob e84fc254dea3 to 50f62a28a05c; the two harness files 14 failed / 268 passed of 282 (every binding pin red, the two new disable pins included; ruling-A, two-App, F1 and F6 CONTROLs green); restored, blob equal to HEAD, git diff HEAD empty.",
  "gates": "On e94a8de8f after pnpm install --frozen-lockfile and full pnpm build (119/119): dispatch-gates --commands derived 94 families on the 6 paths, 94/94 exit 0, each exit captured before any pipe (check:type-check-debt first exit 3 while the dogfood run held the verify lock, re-run with the lock free: exit 0); --ran on the record: 94 derived, 94 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). check-adr-0087-registration --base origin/main exit 0 (registered pair-row-locale-addition-refused, new here). spec check:generated all 14 up to date. pnpm lint exit 0. objectql typecheck exit 0. check-governed-merges --branch HEAD: 0 of 6 paths governed. CI check-runs: none on this head yet (it is not on the PR branch).",
  "dogfood_battery": "e94a8de8f · VERDICT command-exit 0 under scripts/pm/os-verify-lock.sh · Test Files 455 passed, 3 skipped · Tests 3817 passed, 42 skipped · no failures",
  "mcp_calls": "10 — reads only: mcp__github__issue_read x4, mcp__github__pull_request_read x4, mcp__github__get_file_contents x2; no write tool",
  "api_writes": "1 — this comment (POST /repos/objectstack-ai/objectstack/issues/32408/comments through scripts/pm/post-stamped.mjs); git pushes only to claude/project-thread-iv3vz6",
  "open_questions": [
    { "question": "Which branch carries the final head: PR #32557's own branch, or a replacement draft PR?", "options": ["A fast-forward claude/project-thread-3e08el to e94a8de8f, keeping #32557, its reviews and the claim", "B open a replacement draft PR from claude/project-thread-iv3vz6 and close #32557"], "recommendation": "A, because the brief continues the branch and it keeps the review history; it waits on the maintainer's word on the push" }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: a · reach: protocol getMetaItem, the read behind GET /meta/TYPE/NAME, measured in a scratch probe (not over HTTP) · evidence: an email_template member that exists only as a stored row of the App's customization pair (no registry item of that locale), its one holder disabled: the bare read still serves the row, while ADR-0150 D3 withholds a name only disabled packages hold; the stored-row read returns a non-null item and so skips the disabled-holder check in protocol-meta-item-face, and the item's package stamp is the pair, not the disabled holder. Same answer with the binding ablated, so not caused by this PR · dedupe words: disabled holder, pair row, stored row, bare read, withheld",
    "carrier: noted, not filed — handed to the dispatching seat to file or fold into #32561"
  ]
}

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Claim amendment to this seat's takeover claim 6823795824 and amendment 6833847413 on #32408 · 2026-11-12T20:51Z:
Branch: claude/project-thread-iv3vz6 (head e94a8de8f), PR #32815 (draft), which supersedes PR #32557; claude/project-thread-3e08el is left as pushed at 075fb318.
Everything else stands.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Landed: PR #32815 merged as e336a33eb (ACCEPT 6842229958; triage#1 PASS 6841286688 carried by 6841306275 and 6841847606; epic red-line text PASS 6841259753 / 6841299137). The card closed with the merge (Fixes #32408); superseded PR #32557 was closed earlier. Follow-ups stay open under this card: #32899, #32900 (p1), #32901, #32903, #32981.

Unblocked by this landing but left parked under the token-saving order (11-13 01:08Z): #32561 (claude/project-thread-04ua2f@c233053b1) and #32552 (claude/project-thread-31hd5y@d4d32416e) keep their Release: records; whoever resumes them merges main once first.

State: pm:dispatched and pm:blocking removed; card closed.

fix(metadata-protocol): a customization pair's row holds nothing of i…

Navigation Menu

Repository navigation

metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-11T09:58Z

7 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408

Description

Activity

objectstack-fleet commented on Nov 11, 2026

Triage: finding promoted → domain:server · p2 · pm:blocked · 2026-11-11T09:58Z

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

7 remaining items

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-11T09:58Z