metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2)

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Part of #31527. Residual reported under red line 2 by server seat 5's #32408 dev on PR #32557 (head d9d3621f0, measured by the dev). It is outside that PR's surface.

The divergence. App A's pair A.custom stores a row with no overrides.package, for a bundle member (for example the fr-FR locale of an email template). Package X of A holds the name. Package Z also holds it, as a bundle addition that ships that same member (fr-FR).

The registry (SchemaRegistry#pairRowBinding after fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32557) counts Z as a second owner for that member, because Z ships it, and binds the row to no package. It does not guess.
The exact read (pairRowOnAddress, @objectstack/metadata-protocol) counts holders after binding. It counts Z as an addition, not a holder, so ?package=X serves the row as X's customization.
Binding the row to X in the registry instead makes the exact read refuse at X. The two readers have no common answer under the current holder counting.

Ruling direction (epic seat). Red line 2 governs: an undeclared row that could customize either X's or Z's member is not attributed to one of them. The exact read adopts the registry's count. When an addition ships the row's member, the undeclared pair row is no owner's row at ?package=X and ?package=Z. Each address answers its own shipped item, and ?package=A.custom still serves the row. A row that declares its base (overrides.package) binds as declared, unchanged. Declare it FROM → TO with Clause-②: yes (narrowing) and pin both orders.

Premise re-check. The fixture in PR #32557's counter-example pin (package-scoped-exact-qualifier.test.ts, added at d9d3621f0). Read ?package=X after #32557 lands. If it answers the row, the premise holds.

Blocked-by: #32408

fix(objectql): a pair row whose count would read another App's undecl…

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-12T06:02Z

⛔ Not a claim.

Lane: domain:server (@objectstack/metadata-protocol pairRowOnAddress, against the registry's pairRowBinding). Already linked under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.
Edge: the body's Blocked-by: #32408 is indexed; metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408 is open (pm:dispatched, PR fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32557). Grade: p2, as metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408.
Direction: the epic seat's red line 2 reading (the exact read adopts the registry's count, declared FROM → TO as Clause-②: yes (narrowing)) is within ADR-0150 D4 and its epic ruling, so no decision card.

Generated by Claude Code

domain:server#5 · os-bill · session_01Utp6CX9R5BLZwgJDeivmA7

Claim: PM loop round 2 · epic #31527 wave 2
Session: session_01Utp6Cak9TkDzAwjuEej19g (card thread; seat session session_01Utp6CX9R5BLZwgJDeivmA7)
Account: os-bill
Branch: claude/project-thread-u392g8
Worktree: objectstack-issue-32561
Domain: domain:server
Seat: domain:server#5
File surface: packages/metadata-protocol/src/protocol-exact-qualifier.ts (pairRowOnAddress) + tests; packages/objectql/src/registry.ts read-only reuse of the owner rule (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high (p2)
Clause-②: no (narrowing) — expected: an undeclared App-pair row an addition also ships is no owner's row at ?package=X / ?package=Z; the dev declares every moved answer FROM → TO
Metadata-protocol: narrowed (expected; dogfood battery and a contract review owed)
Responsibility: platform code in objectstack (exact read vs registry pair-row binding) produces the risk · no platform path covers it today · reach: an App pair row beside a bundle addition shipping the same member; first-party expected 0
Thread-read: 6816038602
Premise: holds (measured by #32408's dev on PR #32557 d9d3621f0; the thread re-measures on the start head)
Serial constraints cleared: lands after PR #32557 (#32408).
Ruling carried: epic seat (card body): "The exact read adopts the registry's count. When an addition ships the row's member, the undeclared pair row is no owner's row at ?package=X and ?package=Z."; also covers #32557's second residual (cross-pair undeclared-row dependency).
Start: locally from PR #32557's head claude/project-thread-3e08el@075fb3188b; ⛔ no push until #32557 merges; then merge origin/main (never rebase), push, draft PR. Order: epic #31527 seat 1 wave 2. Epic red-line read owed by epic:#31527#1 before ACCEPT.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Release: claim 6817584502 (domain:server#5 · os-bill · seat session session_01Utp6CX9R5BLZwgJDeivmA7, dev session session_01Utp6Cak9TkDzAwjuEej19g) is withdrawn by takeover.
Provenance: the maintainer, verbatim 「开座位接手 objectstack-ai/objectstack 的专题 #31527（ADR-0150）…再开 2 个 server 座位接卡」 (project "Objectstack security ui", project timeline, 2026-11-12T12:24:11Z), with the outgoing holder's handover to "a new server seat on another account" at 6823237839 (server seat 5 section). The seats split the handover at the seating comment 6823665821 on #6367.

Claim: PM loop round 1 · takeover of a live claim on the maintainer's word
Session: session_01L6bhgVaKJ9TPfXPRhdqx3e (seat; the card's next dev or card thread is named in a claim amendment before it starts)
Account: os-sales
Branch: claude/project-thread-u392g8
Worktree: objectstack-issue-32561
Domain: domain:server
Seat: domain:server#1
File surface: packages/metadata-protocol/src/protocol-exact-qualifier.ts (pairRowOnAddress) + tests; packages/objectql/src/registry.ts read-only reuse of the owner rule (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high (p2)
Clause-②: no (narrowing) — expected: an undeclared App-pair row an addition also ships is no owner's row at ?package=X / ?package=Z; the dev declares every moved answer FROM → TO
Metadata-protocol: narrowed (expected; dogfood battery and a contract review owed)
Responsibility: platform code in objectstack (exact read vs registry pair-row binding) produces the risk · no platform path covers it today · reach: an App pair row beside a bundle addition shipping the same member; first-party expected 0
Thread-read: 6817584502
Premise: holds (measured by #32408's dev on PR #32557 d9d3621f0; the thread re-measures on the start head)
Serial constraints cleared: lands after PR #32557 (#32408).
Ruling carried: epic seat (card body): "The exact read adopts the registry's count. When an addition ships the row's member, the undeclared pair row is no owner's row at ?package=X and ?package=Z."; also covers #32557's second residual (cross-pair undeclared-row dependency).
Start: locally from PR #32557's head claude/project-thread-3e08el@075fb3188b; (historical; the branch is now pushed, see the handover record below). Epic red-line read owed by epic:#31527#1 before ACCEPT.
Resume-from: claude/project-thread-u392g8@65a7c73f4b5581f7fbde3ed4db09b1bfd2591e0c

Handover record: last pushed claude/project-thread-u392g8@65a7c73f4b5581f7fbde3ed4db09b1bfd2591e0c (read with git ls-remote at this takeover). State: pushed, no PR (on 075fb31, 3 commits); waits on PR #32557; #32606 follows it.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Possible residual shape for this card (not checked), from the epic red-line delta read 6841098779 of PR #32815, "Older than this PR": in the reverse-order state the doors leave (W of the App holds, X refused), W's exact address serves the row declared for X, which holds nothing, on BASE and at the head alike; the registry binds that row to no package. The next claimant checks whether it is one of the residual shapes this card carries.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Back to queue · 2026-11-13T11:03Z · pm:on-hold → pm:queue, on the maintainer's word relayed by the coordinator (「暂停的卡交回队列了吗」 / 「是的」, 2026-11-13 11:01Z). Supersedes the pause in Release 6840797479; no claim stands and no one is assigned.

Resume-from: claude/project-thread-04ua2f@c233053b1e15b780de27546a4c01b15ed3f8b8a8

Done: residual (3) ruled C (6837007729) and implemented (SchemaRegistry#overlayRowBinding counts served holders; the exact read treats an undeclared pair row as not-member when the one served owner is not the bound one). Semantic entry pair-row-exact-read-no-owner (registered) and the spec changeset written; ablations hold at c233053b1. Clause-②: yes (narrowing) per the claim amendment.
The blocker is gone: fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32815 merged as e336a33eb (metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408 closed).
Left: merge main once (never rebase), rebuild objectql, metadata-protocol and spec, re-run the two harness files and the ablations, dispatch-gates, the ADR-0087 gate, spec check:generated, lint, typecheck and one dogfood run; open the draft PR through the relay pr_create citing 6837007729 for residual (3); contract review through triage (pm:mailbox — triage#1 · hotlong #32588).
Not here: the bare read ignoring a declared override is metadata-protocol: the bare member read ignores a pair override declared for an addition package's own locale member #32849. The 18.4.0 merge freeze ([sweep] v18.4.0 release test sweep #32908 6848983225) holds changeset PRs out of the queue until chore: version packages #29963 merges.

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Claim: PM loop round 3 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; #32354's PR #33130 (shared protocol-exact-qualifier.ts) merged · 2026-11-13T18:25Z
Session: session_016WV4czFhtRVZNBeHdQA6PW
Account: os-elon-musk
Branch: provisional — the card thread re-posts this claim with its own claude/project-thread-* branch, resuming from claude/project-thread-04ua2f@c233053b1e15b780de27546a4c01b15ed3f8b8a8 (Resume-from 6850998457)
Worktree: objectstack-issue-32561
Domain: domain:server
Seat: epic:#31527#2
File surface: as the takeover claim 6823829063 with amendments 6836618885 and 6836951859: packages/metadata-protocol/src/protocol-exact-qualifier.ts + tests, packages/objectql/src/registry.ts (SchemaRegistry#overlayRowBinding), the spec semantic entry and changesets. Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: yes (narrowing)
Metadata-protocol: narrowed
Responsibility: platform code in objectstack (the exact read vs the registry's pair-row binding); no other platform path covers it; reached by an App pair row beside a bundle addition shipping the same member, first-party expected 0
Thread-read: 6850998457
Premise: holds (blocker #32815 merged as e336a33eb; the thread re-reads every comment first)
Serial constraints cleared: #32354's PR #33130 merged; #32552's PR #33129 no longer touches registry.ts or the migration entry. #32607 shares protocol-exact-qualifier.ts and runs after this card lands.

epic:#31527#2 · os-elon-musk · session_016WV4cwzajrQVjjx4Dh1CA5

Claim: PM loop round 3 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; #32354's PR #33130 (shared protocol-exact-qualifier.ts) merged · re-posted by the card thread at 2026-11-13T18:35Z
Session: session_016WV4cwzajrQVjjx4Dh1CA5 (card thread; seat session session_016WV4czFhtRVZNBeHdQA6PW)
Account: os-elon-musk
Branch: claude/project-thread-m1qqn5 (the thread's harness branch; it starts from claude/project-thread-04ua2f@c233053b1e15b780de27546a4c01b15ed3f8b8a8 (Resume-from 6850998457) and merges origin/main, never rebases; project-thread-04ua2f is left as pushed)
Worktree: objectstack-issue-32561
Domain: domain:server
Seat: epic:#31527#2
File surface: as the takeover claim 6823829063 with amendments 6836618885 and 6836951859: packages/metadata-protocol/src/protocol-exact-qualifier.ts + tests (packages/objectql/src/package-scoped-exact-qualifier.test.ts, package-scoped-resolver.test.ts), packages/objectql/src/registry.ts (SchemaRegistry#overlayRowBinding), the spec semantic entry 18.pair-row-exact-read-no-owner.ts and the 32561-* changesets. PR #32815's round-3 files and changesets leave the diff at the origin/main merge (each takes main's landed copy, e336a33eb). Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: yes (narrowing)
Metadata-protocol: narrowed
Responsibility: platform code in objectstack (the exact read vs the registry's pair-row binding); no other platform path covers it; reached by an App pair row beside a bundle addition shipping the same member, first-party expected 0
Thread-read: 6861484508
Premise: holds (blocker #32815 merged as e336a33eb; every comment re-read; re-measured on the merged head)
Serial constraints cleared: #32354's PR #33130 and #32613's PR #33126 merged and are in the merged head; #32552's PR #33129 no longer touches registry.ts or the migration entry. #32607 shares protocol-exact-qualifier.ts and runs after this card lands.

epic:#31527#2 · os-elon-musk · session_016WV4cwzajrQVjjx4Dh1CA5
os-dev-report

{
 "issue": 32561,
 "status": "done",
 "branch": "claude/project-thread-m1qqn5",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/33148",
 "session": "session_016WV4cwzajrQVjjx4Dh1CA5",
 "premise_still_valid": true,
 "summary": "Resumed claude/project-thread-04ua2f@c233053b1e and merged origin/main once (bf02d33bd, merge commit 72c8a9c8ef). The four conflicts (objectql registry.ts, the two package-scoped test files, 18.pair-row-locale-addition-refused.ts) came from the branch carrying PR #32815's round-3 head: each takes main's landed copy (e336a33eb) with the card's four commits (1c1342c9fe, d9a7d640ca, 65a7c73f4b, df0b5fa73d) replayed onto it, and the two 32408-* changesets stay deleted (consumed by #29963). Measured: the card's +/- lines vs main equal the branch's delta over #32815's head c3cc324b1, apart from main's own permission-set lines; the diff vs main is the card's seven files. The exact read (pairRowOnAddress) adopts SchemaRegistry#overlayRowBinding (new, read-only, over the served holders) for an undeclared App-pair row: residuals 1 and 2 narrow as the card says, residual 3 kept per ruling C (6837007729). Declared Clause-②: yes (narrowing) / Metadata-protocol: narrowed (minor on metadata-protocol and objectql, adr-0087 registered entry pair-row-exact-read-no-owner), matching claim re-post 6861691935.",
 "tests": "head 72c8a9c8ef. Focused package-scoped-exact-qualifier.test.ts + package-scoped-resolver.test.ts: 369/369. metadata-protocol: Test Files 337 passed | 7 skipped (344), Tests 22803 passed | 36 skipped, typecheck exit 0 (lock VERDICT command-exit 0). objectql: Test Files 595 passed (595), Tests 12837 passed, typecheck exit 0. Ablation 1: pairRowOnAddress's new line guarded off via ablation-replace, metadata-protocol rebuilt, ablation-dist-preflight marker present in 2 built files: 3 failed / 366 passed (the three NARROWING pins; 'AssertionError: `?package=X`: X ships no fr-FR: expected { name: welcome, ...(6) } to be undefined'); restore blob == HEAD, git diff HEAD empty, rebuilt, marker absent from all 24 built files. Ablation 2: overlayRowBinding over every holder (registry.ts imported relatively, no build): 5 failed / 364 passed (two residual-3 CONTROLs + three #32183/#32408 disable pins; 'the adoption counts the served holders: expected undefined to be com.acme.suitex'); restored, 369/369.",
 "gates": "dispatch-gates --commands: 94 commands from 7 paths vs merge base bf02d33bd; 93 exit 0; pnpm check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (needs full pnpm build) = NOT MEASURED, CI runs it. dispatch-gates --ran: 94 accounted, 93 run, 1 NOT-MEASURED. pnpm lint exit 0. check-closing-keyword-parity --body: only #32561 bound. PR check-runs: in_progress at report time (CI started on PR open); the seat reads them before ACCEPT.",
 "dogfood_battery": "72c8a9c8ef · os-verify-lock VERDICT command-exit 0 · Test Files 460 passed | 3 skipped (463) · Tests 3886 passed | 42 skipped (3928) · no failure",
 "mcp_calls": "5 — read-only: issue_read get/get_comments/get_sub_issues on #32561, pull_request_read get on #33148 (x1), plus one gh api read of #31527's body; no MCP write",
 "api_writes": "4 via the fleet-write relay: claim re-post comment 6861691935 on #32561; pr_create #33148 (+ assignees leg os-elon-musk); contract-review ring 6863087504 on review#1 mailbox #33116; this os-dev-report comment. Plus two git pushes (branch claude/project-thread-m1qqn5).",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: epic:#31527#2 seat · the 'possible residual shape' in card comment 6841146506 (epic red-line read 6841098779: W's exact address serves a row DECLARED for X when X holds nothing) is a declared-row shape; the card body keeps declared rows unchanged, so it is not this card's and this PR does not move it. Not measured here; the seat decides whether to have it measured and carded."
 ]
}

epic:#31527#2 · os-elon-musk · session_016WV4cwzajrQVjjx4Dh1CA5

Reading for the seat (no code change, no push) · the residual shape in 6841146506 · 2026-11-13T19:47Z

Verdict: (b) main's and unchanged by PR #33148, outside this card.

Shape driven (objectql exact-qualifier harness double, scratch file deleted after): App A, its pair A.custom; W (com.other.wolf, a module on A and X, own namespace) registers the de-DE member of email template welcome; a stored row of A.custom for de-DE declares overrides.package: X; the seal runs; X then arrives with en-US and is refused at the item door ("Bare-name conflict … already holds", X's manifest installed) and at the package door (X not installed). Same cells at both doors.

Cell	`origin/main` copies of the two source files	head `72c8a9c8ef`
holders	`[W]`	`[W]`
registry item at W, `de-DE`	W's own (`wolf de-DE`)	same
`overlayRowBinding` of the row	n/a	`undefined` (no package)
`?package=W&member=de-DE`	the row declared for X, stamped W	same
W's list / execution list	carry the row	same
`?package=X&member=de-DE`	409 naming W	same
`?package=A.custom&member=de-DE`	the row, stamped W	same

So W's exact address, list and execution list serve a row declared for a package that holds nothing, while the registry binds it to no package: the read note holds as written, on main and at this head alike. The row declares its base, and this PR changes only the reading of undeclared pair rows, so it does not move. Which read path serves it was not diagnosed. Not probed: the protocol's save door (the row was hydrated as stored), a cold boot.

Navigation Menu

Repository navigation

metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-12T06:02Z

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561

Description

Activity

objectstack-fleet commented on Nov 12, 2026

Triage: finding promoted → domain:server · p2 · pm:blocked · 2026-11-12T06:02Z

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

8 remaining items

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `finding` promoted → `domain:server` · p2 · `pm:blocked` · 2026-11-12T06:02Z