metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3)

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Triage edited only the Blocked-by: line (lifted); the rest is the filer's text, unchanged.

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Filing category: ① product defect with a named location (out-of-scope finding of #32354's step 0, measured on claude/project-thread-phk4r9 @ 6655b742; note /mnt/project-files/server-seat3-p2/card-32354/step0.md). #32354 covers the case where one holder is disabled; this card is the same order guess with no disabled package.
Part of #31527 (ADR-0150) · Refs #32354

维护者速读

改什么：两个启用包各存了一行同名项、没有包在代码里自带它时，不带包名的读取要像 /layers 一样答 409 并点名两个包，而不是按保存顺序给第一行。
为什么：现在同一个名字，裸读答"先保存的那一行"，/layers 却答 409；答案靠保存顺序猜，违反专题红线"歧义要报告、不许猜"。
风险：第一方 0 处；裸读 200 → 409（收窄，需声明并钉住）。
先看：packagelessAddress 的候选 → packagelessContentPackage（无代码持有者时为 undefined）→ findServedOverlayRow 取第一行。
验证：E、F 都启用，各存一行 d1，两种保存顺序下裸读都应 409 点名 E、F。
需要你做的：无，归专题席派发。

What happens

packagelessAddress candidates are both row bindings; with no package shipping the name, packagelessContentPackage answers undefined, and findServedOverlayRow takes the first row by save order. packagelessLayeredReadRefusal counts both bindings and answers 409. So the bare read and /layers disagree, and the bare read is a guess by order.

Do

The bare read of a name with two or more served row holders and no shipper answers the same 409 RESOURCE_CONFLICT with details.candidates naming each served holder that /layers gives. Pin both save orders, both transports; CONTROL: one row holder answers unchanged. FROM → TO: bare read 200 (first-saved row) → 409 naming both (narrowing, Clause-② yes).

Reuse #32354's row-aware served-holder judgment (it lands the served set over registry holders ∪ stored-row bindings).
Was blocked by #32354; its row-aware served-holder judgment landed in PR #33130 (02f55c5d22). The serial predecessor on protocol-exact-qualifier.ts, #32561, landed in PR #33148 (89d7bef033). The block was lifted by triage on 2026-11-13: #32354 stays open only for its list-door cases, which this bare-read card does not use.
Reader who acts: the server seat the epic seat routes it to. Epic red-line read before landing.
Grade: p2 (first-party reach 0).

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim: PM loop round 8 · #32607 · 2026-11-12T09:26Z · bug (p2, epic #31527 family, routed by the epic seat)
Session: session_01Utp6CaAUev5V62cLHhQwBi (seat); dev = card thread session_01Utp6CaeiHam9WpVidmNqff
Account: os-bill
Branch: claude/project-thread-j3i5j5 (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-32607
Domain: domain:server
Seat: domain:server#3
File surface: packages/metadata-protocol/src/** and tests, transport answer tests, one changeset (stop on breach; packages/spec/**, docs/adr/**, .claude/** excluded)
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: yes (expected: bare read 200 first-saved row → 409 naming both, a narrowing; step 0 declares each FROM → TO)
Metadata-protocol: none (expected; step 0 declares)
Responsibility: the bare read of a name held only by stored rows of two or more served packages and shipped by none answers 409 with details.candidates, as /layers does, reusing #32354's row-aware served-holder judgment
Thread-read: none
Premise: measured at step 0 on claude/project-thread-phk4r9 plus #32354's local patch before any edit; premise_still_valid: false is a valid result
Serial constraints cleared: Blocked by #32354 (local, not pushed) and #32183 (PR #32497): work starts locally from phk4r9 plus card-32354/32354.patch. Nothing is pushed until both merge; then main is merged in (never rebase) and a draft PR opens. Epic red-line read before ACCEPT; needs_decision goes to the epic seat.
Label: pm:blocked → pm:dispatched (a live claim works it from the blocker's head; the Blocked-by: line in the body stays and still gates the push and the landing).

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim amendment: #32607 · 2026-11-12T09:34Z · seat ruling on step 0 (note /mnt/project-files/server-seat3-p2/card-32607/step0.md, measured on claude/project-thread-phk4r9 @ 6655b742 + #32354's local patch; both transports, both registration orders, before and after reboot)

Fix as proposed. servedRowHolderOf drops its "no disabled package, return early" gate on the refusal arm only. Two or more served holders give the existing ambiguous-in-environment refusal with details.candidates. One or fewer behave as before. No second counting pass. The trial patch moved the bare read, /layers and /published to 409 naming E and F, and left exact addresses, pair addresses and the single-holder CONTROL unchanged.

Moved answers (Clause-② yes, narrowing):

Bare read: 200 (first-saved row) → 409.
Execution face: the same move. It is read from code, so pin it.
/published: 200 (REST by save order; runtime always E) → 409.
/layers: 409 → 409, with the sentence changed to the package-scoped refusal sentence.

Q1, the /layers sentence change: accepted. The status and details.candidates stay. Declare the sentence move in the PR.

Q2, the pair-address order guess after a reboot: a separate card, filed as #32662. It belongs to the exact-qualifier face, which #32501 owns, and it is a widening. It is not fixed here.

Q3, pin /published on both transports: yes.

Pin both save orders, both registration orders, before and after a reboot, on both transports. Ablate once. Review: CONTRACT_REVIEW_TIER plus the epic red-line read.

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim amendment: #32607 · 2026-11-12T10:05Z · seat re-ruling on Q1 (replaces the Q1 line of the step-0 ruling)

Q1 re-ruled: A, /layers does not move. The build turned 3 pins of #28337 red. They are rest/meta-layers-ambiguous-package.test.ts and the runtime twin's RestServer and hono cases. Those pins hold the contract that a package-less /layers answers the same refusal as the package-less write door (PUT/DELETE): the same envelope, the leading sentence "Name the package this layered read is for", and the ?package= remedy. Step 0 had not seen that contract. With no disabled package, packagelessLayeredReadRefusal keeps that refusal. The new ambiguous-in-environment refusal applies only to the bare read, /published and the execution face. Both refusals are 409 RESOURCE_CONFLICT naming both holders, which meets the card. The #28337 pins stay untouched, and the PR declares one move fewer. Carrying details.candidates on /layers remains #32622's job.

Metadata-protocol: none (accepted). No key, value, type or authoring requirement moves. The narrowing is in read answers only, on Clause-②'s narrowing arm, consistent with #32354.

domain:server#3 · os-bill · session_01Utp6CaAUev5V62cLHhQwBi

Claim amendment: #32607 · 2026-11-12T10:28Z · file surface widened by one file (A1)

A1 accepted. The file surface gains packages/rest/src/rest-server.ts, one hunk of about 10 lines in the layered chain. Step 1b (metaItemReadGateSources.isItemOfDisabledPackage) calls a package-less getMetaItem to find the owner. Since the bare read now refuses, that call throws before step 1c (packagelessLayeredReadRefusal) can answer the write-door refusal that #28337 pins.

The new behaviour: when step 1b's getMetaItem throws on a package-less address and packagelessLayeredReadRefusal has a refusal, step 1b returns false and hands over to 1c. In every other case it rethrows as before. All three #28337 pins stay green, and the answers for two registry holders and for #32354's Q2 do not move, because 1c returns no refusal there.

A2, rewording the REST #28337 pin so the two transports' sentences differ, is declined. Note for #32624, the REST /layers door that answers 200 with two registry holders: it touches the same chain and is sequenced after this card.

domain:server#7 · os-sales · session_01L6bhgVSjQBHNkZd6Eqx2XX

Takeover · #32607 · 2026-11-12T12:41Z (four pieces in one comment, execution-duties.md 〈认领〉)

① Release (cross-account): the claim 6819852006 held by os-bill (seat domain:server#3) is released. Whose order: the maintainer. Verbatim: 「开 1 个专题座位负责串行主链和红线复读，再开 2 个 server 座位接卡」 (2026-11-12T12:24:11Z, the os-sales account's project chat), executing the previous holder's handover on #31527 (comments 6823237839, 6823302333), which names a new server seat on another account as the taker.

② Assignee: os-bill → os-sales in the same stroke as this comment; pm:dispatched stays.

③ Claim:

Claim: takeover · #32607
Session: session_01L6bhgVSjQBHNkZd6Eqx2XX (seat; a card thread's session and branch follow in a claim amendment on dispatch)
Account: os-sales
Branch: branch claude/project-thread-j3i5j5 @ f073c310e, no PR
Worktree: a card thread's checkout of that branch
Domain: domain:server
Seat: domain:server#7
File surface: carried from claim 6819852006 and its amendments, unchanged
Container & model: M, mode:thread, model: default tier, effort: high
Clause-②: yes (expected: bare read 200 first-saved row → 409 naming both, a narrowing; step 0 declares each FROM → TO)
Metadata-protocol: none (expected; step 0 declares)
Responsibility: carried from claim 6819852006
Thread-read: 6821134180
Premise: holds (carried; re-read at the next dispatch step)
Serial constraints cleared: as stated in ④

④ Next: waits on PR #32497 and #32354's PR; merge pv4nip in and drop the patch copy cb73bf6. Every landing first gets the epic seat's red-line re-read.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · state → `pm:blocked` · 2026-11-13T08:30Z

⛔ Not a claim; the claim (if any) is unchanged.

Line: readers of a stored-row-only name of two enabled packages · bare read · rare · measured
Why: The bare read answers by save order (silent pick, p1 row) in a rare two-package arrangement, discounted to p2; Blocked-by metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354 is open.
Rule: the card was filed already carrying a grade and state and had no triage audit; this is that audit, under the adopted grading rules (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). The state moves because an edge in Blocked-by: is still open.

Generated by Claude Code

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: unblocked → `pm:queue` · 2026-11-13T22:08Z

Asked by epic:#31527#2 (6866116331). metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 is the bare read with no disabled package. What it reuses from metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354 is the row-aware served-holder judgment, and that landed in PR fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 (02f55c5d22). metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354 stays open only for its list-door cases (epic note 6820147040: lists beside a disabled holder), which this card does not touch. The other serial predecessor on protocol-exact-qualifier.ts, metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561, landed in PR fix(metadata-protocol)!: the exact read no longer serves an undeclared App-pair row the registry binds to no package; it adopts SchemaRegistry#overlayRowBinding over the served holders (ADR-0150 D4) #33148 (89d7bef033).
So there is no remaining dependency: the Blocked-by: line is lifted in the body and the card goes to the queue. Grade unchanged (p2). The branch claude/project-thread-j3i5j5@d721d9a125 exists, so the epic seat may claim and resume it.

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Claim: PM loop round 4 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; unblocked by triage 6866148987 (no dependency on #32354's list-door remainder); serial predecessors on protocol-exact-qualifier.ts landed: #33130 (#32354) and #33148 (#32561) · 2026-11-13T22:10Z
Session: session_016WV4czFhtRVZNBeHdQA6PW
Account: os-elon-musk
Branch: provisional — the card thread re-posts this claim with its own claude/project-thread-* branch, resuming from claude/project-thread-j3i5j5@d721d9a1250658d4c9b1bf26e0f5b648899a8d1f (Resume-from 6840760147)
Worktree: objectstack-issue-32607
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6819852006 with amendments 6821134180 (packages/rest/src/rest-server.ts, one hunk) and 6836791341 (packages/runtime/src/domains/meta.ts): packages/metadata-protocol/src/** and tests, transport answer tests, the spec semantic entry if narrowed is declared, changesets. Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: yes (expected: bare read 200 first-saved row → 409 naming both, a narrowing; the thread declares each FROM → TO)
Metadata-protocol: to be declared by the thread from the diff (a refusal of a read that served before is narrowed, per review#1's ruling on #33121)
Responsibility: the bare read of a name held only by stored rows of two or more served packages and shipped by none answers 409 with details.candidates, as /layers does, reusing #32354's row-aware served-holder judgment (now on main via #33130)
Thread-read: 6866138343
Premise: re-measured by the card thread on the merged head before any edit; premise_still_valid: false is a valid result
Serial constraints cleared: #33130 merged (02f55c5d22), #33148 merged (89d7bef033); no other open PR of this seat touches protocol-exact-qualifier.ts (#33149 touches protocol-registry-hydration.ts only).

epic:#31527#2 · os-elon-musk · session_016WV4czBmkW6UeWPazkWq7L

Claim: PM loop round 4 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; unblocked by triage 6866148987 (no dependency on #32354's list-door remainder); serial predecessors on protocol-exact-qualifier.ts landed: #33130 (#32354) and #33148 (#32561) · re-posted by the card thread at 2026-11-13T22:13Z
Session: session_016WV4czBmkW6UeWPazkWq7L (card thread; seat session session_016WV4czFhtRVZNBeHdQA6PW)
Account: os-elon-musk
Branch: claude/project-thread-loearv (the thread's harness branch; it starts from claude/project-thread-j3i5j5@d721d9a1250658d4c9b1bf26e0f5b648899a8d1f (Resume-from 6840760147) and merges origin/main, never rebases; project-thread-j3i5j5 is left as pushed)
Worktree: objectstack-issue-32607
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6819852006 with amendments 6821134180 (packages/rest/src/rest-server.ts, one hunk) and 6836791341 (packages/runtime/src/domains/meta.ts): packages/metadata-protocol/src/** and tests, transport answer tests, the spec semantic entry if narrowed is declared, changesets. Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: yes (expected: bare read 200 first-saved row → 409 naming both, a narrowing; the thread declares each FROM → TO)
Metadata-protocol: to be declared by the thread from the diff (a refusal of a read that served before is narrowed, per review#1's ruling on #33121)
Responsibility: the bare read of a name held only by stored rows of two or more served packages and shipped by none answers 409 with details.candidates, as /layers does, reusing #32354's row-aware served-holder judgment (now on main via #33130)
Thread-read: 6866165511
Premise: re-measured by the card thread on the merged head before any edit; premise_still_valid: false is a valid result
Serial constraints cleared: #33130 merged (02f55c5d22), #33148 merged (89d7bef033); no other open PR of this seat touches protocol-exact-qualifier.ts (#33149 touches protocol-registry-hydration.ts only).

epic:#31527#2 · os-elon-musk · session_016WV4czBmkW6UeWPazkWq7L
os-dev-report

{
 "issue": 32607,
 "status": "done",
 "branch": "claude/project-thread-loearv",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/33182",
 "session": "session_016WV4czBmkW6UeWPazkWq7L",
 "premise_still_valid": true,
 "summary": "Resumed claude/project-thread-j3i5j5@d721d9a125 and merged origin/main 89d7bef033 once (3b9a447dc3), taking main's landed #33130/#33148 copies and dropping patch copy cb73bf6c; the diff vs main is the card's eight files. Premise re-measured on main: the bare read of two enabled row holders still answered by save order (runtime pins 4 red). The item face now refuses two or more served row holders of a name no enabled package ships at any member (409 RESOURCE_CONFLICT, details.candidates); /layers keeps the package-less writes' refusal via the A1 hand-over on both transports. The first dogfood battery caught an over-reach (email_template member read with a shipping base, three #28802 pins); abd91aad9e adds the shipped-name guard. Declared Metadata-protocol: narrowed (moved from the claim of record's none per review#1 on #33121): metadata-protocol minor, BREAKING, adr-0087 registered two-row-holders-bare-read-refused.",
 "tests": "metadata-protocol test on 5d3a6c757c: 337 files passed/7 skipped, 22803 tests passed/36 skipped, typecheck 0. On 3b9a447dc3: rest 409/409 files, 8358 passed/332 skipped; runtime 597/597 files, 10596 passed/19 skipped; typecheck metadata-protocol/rest/runtime/spec 0. Focused on abd91aad9e: runtime stack 22/22, REST doors+#28337 42/42, dogfood #28802 file 13/13. Ablation 1 (item-face option folded to false, rebuilt, dist marker 'refuseWithoutDisabled: false }' in 2 files): runtime 4 red/22, REST 6 red/39; restored, --absent clean. Ablation 2 (REST A1 hand-over -> throw, src import): 3 red/42; restored. Ablation 3 (shipped-name guard, marker __ABL32607B in 2 dist files): dogfood #28802 3 red/13; restored, --absent clean.",
 "gates": "dispatch-gates --commands: 95 derived vs merge base 89d7bef03; 94 exit 0; check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (NOT MEASURED, CI). --ran: 95 accounted for, 94 run, 1 NOT-MEASURED. pnpm lint exit 0 on 5d3a6c757c. CI check-runs: in_progress at report time.",
 "dogfood_battery": "5d3a6c757c · VERDICT command-exit 0 · Test Files 462 passed, 3 skipped (465) · Tests 3905 passed, 42 skipped (3947) · no failure (first battery on 3b9a447dc3: 1 file / 3 tests red, fixed in abd91aad9e)",
 "mcp_calls": "3 — mcp__github__issue_read (get, get_comments on #32607); reads only",
 "api_writes": "4 — via fleet-write relay: POST comment #32607 (claim re-post 6866219396), pr_create #33182 (draft, assignee os-elon-musk), POST comment #33116 (review#1 ring 6868544976), POST comment #32607 (this report)",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: #32662 · the paired customization address after a reboot follows the registry's one bare slot (noted, not filed)",
  "carrier: #32622 · details.candidates on /layers (noted, not filed)",
  "carrier: #32624 · REST /layers answers 200 for two registry holders, same chain, sequenced after this card (noted, not filed)"
 ]
}

fix(metadata-protocol): round 2 of #32607 — one read of the item's ac…

Merge remote-tracking branch 'origin/main' into claude/project-thread…

Navigation Menu

Repository navigation

metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607

维护者速读

What happens

Do

16 remaining items

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · state → `pm:blocked` · 2026-11-13T08:30Z

Triage: unblocked → `pm:queue` · 2026-11-13T22:08Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607

Description

维护者速读

What happens

Do

Activity

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

16 remaining items

objectstack-fleet commented on Nov 13, 2026

Triage: first-touch audit (pre-labeled card) · p2 confirmed · state → pm:blocked · 2026-11-13T08:30Z

objectstack-fleet commented on Nov 13, 2026

Triage: unblocked → pm:queue · 2026-11-13T22:08Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · state → `pm:blocked` · 2026-11-13T08:30Z

Triage: unblocked → `pm:queue` · 2026-11-13T22:08Z