metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2)

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Parent: #31527 (ADR-0150, epic red line 2: ambiguity reported, never guessed). Found by server seat 5 while working #32552 (finding F1). Measured on 238b9ee69 with #32568's locations 1–4 applied locally. #32568's hydrator fix does not cover it. Probe: /mnt/project-files/server-seatC/card-32552/probe-32552.test.ts (PROBE2).

Premise

Two namespaces, alpha and beta, each ship flow F, and each has a declared .custom override row bound to its own package (OVR-A and OVR-B). getMetaItemsForExecution({ type: 'flow' }) answers by registration order:

alpha registered first: alpha:OVR-A twice, alpha:OVR-B, beta:OVR-B
beta registered first: alpha:OVR-A, beta:OVR-A, beta:OVR-B twice

So one package's override is executed under the other package's name. The answer also changes with registration order.

Likely root (the finder's reading): the pair's already-bound rows enter the same bare slot through incomingTakesStoredFlowSlot in packages/metadata-protocol/src/protocol-registry-hydration.ts (around :526). #32568's fix deliberately does not touch flows or bound pair rows.

After #32552's fix, action shows the same wrong entry (alpha:OVERRIDE-beta when alpha registers first). So #32552 waits for this card (epic ruling, 2026-11-12 08:00Z).

Fix shape

Each bound override row goes into its own package's slot, and is never taken by the bare slot when two packages hold the name.
Sweep every reader of incomingTakesStoredFlowSlot, plus the other execution-face readers, for the same shortcut. Cover flow and action.
Pin both registration orders. Expected answer: exactly alpha:OVR-A and beta:OVR-B. Add a one-holder CONTROL.
Declare the move FROM → TO with its arm. Expected first-party count: 0.

Order

Server seat 5's lane.
Start from PR feat(objectql)!: two namespaces may each ship a flow of one name; addresses, actions and endpoints run their own package's (ADR-0150 child B) #32507's branch (claude/project-thread-wqgmuu). PR feat(objectql)!: two namespaces may each ship a flow of one name; addresses, actions and endpoints run their own package's (ADR-0150 child B) #32507 re-keys flows per package and lands first in the chain.
Lands after metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568 and before metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552.

Blocked-by: #32568

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: `finding` promoted (requested by `domain:server#5`) → `domain:server` · p2 · `pm:blocked` · 2026-11-12T07:59Z

⛔ Not a claim.

Lane: domain:server (packages/metadata-protocol/src/protocol-registry-hydration.ts incomingTakesStoredFlowSlot and the other execution-face readers). Already linked under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.
Edge: the body's Blocked-by: #32568 is indexed; metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568 is open (pm:dispatched). metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568 gets pm:blocking.
Grade: p2, as the red line 2 family (metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568, metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552). One package's bound override executes under another package's name, and the answer depends on registration order. Measured by the seat's probe.
The epic ruling of 08:00Z has metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552 wait on this card; that edge is for the epic seat to write on metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552.

domain:server#5 · os-bill · session_01Utp6CX9R5BLZwgJDeivmA7

Claim: PM loop round 2 · epic #31527
Session: session_01Utp6CXiySYFcrTQXhJqxQZ (card thread; seat session session_01Utp6CX9R5BLZwgJDeivmA7)
Account: os-bill
Branch: claude/project-thread-70eqr9
Worktree: objectstack-issue-32613
Domain: domain:server
Seat: domain:server#5
File surface: packages/metadata-protocol/src/protocol-registry-hydration.ts (incomingTakesStoredFlowSlot) and the other execution-face readers (getMetaItemsForExecution and kin) for flow and action + tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high (p2)
Clause-②: no (narrowing) — epic seat: misattributed list entries that were served disappear and the boot-window answer is corrected; each move FROM → TO with a pin, one-shipper CONTROL
Metadata-protocol: none (epic seat accepted)
Responsibility: platform code in objectstack (packages/metadata-protocol hydration) produces the risk · no platform path covers it today · reach: two packages holding one flow/action name, each with a bound .custom override
Thread-read: 6818127637
Premise: holds (measured by the #32552 and #32568 threads, probe /mnt/project-files/server-seatC/card-32552/probe-32552.test.ts PROBE2; the thread re-measures)
Serial constraints cleared: lane order #32568 → #32613 → #32552; starts from #31696 PR-3 (#32507, wqgmuu).
Ruling carried: epic seat 1 (seat thread, 2026-11-12): "each bound override goes to its own package's slot, never into the bare slot under two holders. Sweep incomingTakesStoredFlowSlot and the other execution-face readers for both flow and action. Pin both orders, expecting exactly alpha:OVR-A and beta:OVR-B, plus a one-holder CONTROL."
Start: locally from PR #32507's head claude/project-thread-wqgmuu; ⛔ no push until #32507 and #32568 merge; then merge origin/main (never rebase), push, draft PR. Epic red-line read owed by epic:#31527#1 before ACCEPT.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Release: claim 6818899830 (domain:server#5 · os-bill · seat session session_01Utp6CX9R5BLZwgJDeivmA7, dev session session_01Utp6CXiySYFcrTQXhJqxQZ) is withdrawn by takeover.
Provenance: the maintainer, verbatim 「开座位接手 objectstack-ai/objectstack 的专题 #31527（ADR-0150）…再开 2 个 server 座位接卡」 (project "Objectstack security ui", project timeline, 2026-11-12T12:24:11Z), with the outgoing holder's handover to "a new server seat on another account" at 6823237839 (server seat 5 section). The seats split the handover at the seating comment 6823665821 on #6367.

Claim: PM loop round 1 · takeover of a live claim on the maintainer's word
Session: session_01L6bhgVaKJ9TPfXPRhdqx3e (seat; the card's next dev or card thread is named in a claim amendment before it starts)
Account: os-sales
Branch: claude/project-thread-70eqr9
Worktree: objectstack-issue-32613
Domain: domain:server
Seat: domain:server#1
File surface: packages/metadata-protocol/src/protocol-registry-hydration.ts (incomingTakesStoredFlowSlot) and the other execution-face readers (getMetaItemsForExecution and kin) for flow and action + tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high (p2)
Clause-②: no (narrowing) — epic seat: misattributed list entries that were served disappear and the boot-window answer is corrected; each move FROM → TO with a pin, one-shipper CONTROL
Metadata-protocol: none (epic seat accepted)
Responsibility: platform code in objectstack (packages/metadata-protocol hydration) produces the risk · no platform path covers it today · reach: two packages holding one flow/action name, each with a bound .custom override
Thread-read: 6818899830
Premise: holds (measured by the #32552 and #32568 threads, probe /mnt/project-files/server-seatC/card-32552/probe-32552.test.ts PROBE2; the thread re-measures)
Serial constraints cleared: lane order #32568 → #32613 → #32552; starts from #31696 PR-3 (#32507, wqgmuu).
Ruling carried: epic seat 1 (seat thread, 2026-11-12): "each bound override goes to its own package's slot, never into the bare slot under two holders. Sweep incomingTakesStoredFlowSlot and the other execution-face readers for both flow and action. Pin both orders, expecting exactly alpha:OVR-A and beta:OVR-B, plus a one-holder CONTROL."
Start: locally from PR #32507's head claude/project-thread-wqgmuu; (historical; the branch is now pushed, see the handover record below). Epic red-line read owed by epic:#31527#1 before ACCEPT.
Resume-from: claude/project-thread-70eqr9@b0c90e96c1cc8a9b3656f6737ad5707684c0838f

Handover record: last pushed claude/project-thread-70eqr9@b0c90e96c1cc8a9b3656f6737ad5707684c0838f (read with git ls-remote at this takeover). State: pushed, no PR (main pre-merged 0410fcf; 7 files +270 −16); waits on #32568's PR merging.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Back to queue · 2026-11-13T11:03Z · pm:on-hold → pm:queue, on the maintainer's word relayed by the coordinator (「暂停的卡交回队列了吗」 / 「是的」, 2026-11-13 11:01Z). Supersedes the pause in Release 6840786599; no claim stands and no one is assigned.

Resume-from: claude/project-thread-63cajz@b777b1b540c6048800b4de02d3f4f51e9c7b4c48

Done: the fix is on the branch; main merged once (a888c5c9e, with fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741). On code head 756a743c5: build 119/119, dispatch-gates 71/71, lint and three-package typecheck 0, three-package tests pass, three ablations hold. The two later commits are changeset text only.
Left: merge main once more (never rebase), re-run dispatch-gates on that head, one dogfood run, fill Verification, open the draft PR through the relay pr_create (body draft /mnt/project-files/briefs/32613-pr-body-r1.md, resume steps /mnt/project-files/briefs/32613-resume.md), then the contract review through triage (Request: contract-review on pm:mailbox — triage#1 · hotlong #32588).
Not here: the census twin is metadata-protocol: the boot census reports a second holder's served declared override as unserved and prescribes deleting the stored row #32859. The 18.4.0 merge freeze ([sweep] v18.4.0 release test sweep #32908 6848983225) holds changeset PRs out of the queue until chore: version packages #29963 merges.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: H14 · `pm:blocking` derived · 2026-11-13T12:19Z

⛔ Not a claim; grade and state unchanged. Open card(s) #32859 name this card on a line-leading Blocked-by:, so the derived cache is added. It comes off when they close or drop the line.

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Claim: PM loop round 2 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」 · 2026-11-13T14:19Z
Session: session_016WV4czFhtRVZNBeHdQA6PW
Account: os-elon-musk
Branch: provisional — the card thread re-posts this claim with its own claude/project-thread-* branch, resuming from claude/project-thread-63cajz@b777b1b540c6048800b4de02d3f4f51e9c7b4c48 (Resume-from 6850983784; notes /mnt/project-files/briefs/32613-resume.md)
Worktree: objectstack-issue-32613
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6823807156: packages/metadata-protocol/src/protocol-registry-hydration.ts, protocol-lock-state.ts, protocol-meta-list-reads.ts, stored-flow-slot.ts + tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: no (narrowing)
Metadata-protocol: none
Responsibility: platform code in objectstack (metadata-protocol execution-face readers); no other platform path covers it; reached by an environment with one pair package's flow/action rows
Thread-read: 6852704233
Premise: holds (carried from the earlier claim and the work on the branch; the thread re-reads every comment first)
Serial constraints cleared: #32820 shares protocol-registry-hydration.ts and runs after this card lands

epic:#31527#2 · os-elon-musk · session_016WV4cwJFqk2CMKeRryL5aB

Claim: PM loop round 2 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」 · card thread re-post of the seat claim 6855632703 · 2026-11-13T14:30Z
Session: session_016WV4cwJFqk2CMKeRryL5aB (card thread; seat session session_016WV4czFhtRVZNBeHdQA6PW)
Account: os-elon-musk
Branch: claude/project-thread-3itv9w (the thread's harness branch; it starts from the Resume-from sha b777b1b540c6048800b4de02d3f4f51e9c7b4c48 of Resume-from 6850983784 and merges origin/main, never rebases; the earlier branch is left as pushed)
Worktree: objectstack-issue-32613
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6823807156: packages/metadata-protocol/src/protocol-registry-hydration.ts, protocol-lock-state.ts, protocol-meta-list-reads.ts, stored-flow-slot.ts + tests (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: no (narrowing)
Metadata-protocol: none
Responsibility: platform code in objectstack (metadata-protocol execution-face readers); no other platform path covers it; reached by an environment with one pair package's flow/action rows
Thread-read: 6855632703
Premise: holds (carried from the earlier claim and the work on the branch; the thread re-reads every comment first)
Serial constraints cleared: #32820 shares protocol-registry-hydration.ts and runs after this card lands

epic:#31527#2 · os-elon-musk · session_016WV4cwJFqk2CMKeRryL5aB
os-dev-report

{
  "issue": 32613,
  "status": "done",
  "branch": "claude/project-thread-3itv9w",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33126",
  "session": "session_016WV4cwJFqk2CMKeRryL5aB",
  "premise_still_valid": true,
  "summary": "Resumed from claude/project-thread-63cajz@b777b1b5 (code head 756a743c5, changeset-only commits after it) and merged origin/main 2c98485d once, no conflict: head c0b7cb13. The fix is unchanged: the env-wide flow/action lists drop a two-shipper override's pair slot, an action's declared override is judged against every shipper (declinesStoredRow), and the boot pull settles the bare flow slot against every shipper (incomingTakesStoredFlowSlot). Every pin answers exactly alpha:OVR-A and beta:OVR-B in both registration orders. Draft PR #33126 opened through the relay; contract review rung on #32588 (6857998578). The resume notes and PR-body draft named by the release comment (/mnt/project-files/briefs/32613-*.md) were not in this project's shared folder, so the PR body and the ablation readings were rebuilt on this head.",
  "tests": "On c0b7cb13: metadata-protocol test: Test Files 337 passed, 7 skipped; Tests 22803 passed. objectql test: Test Files 594 passed (594), Tests 12792 passed. protocol-flow-custom-override.test.ts 23 passed; flow-declared-override-first-boot-pull.integration.test.ts 27 passed. Ablations (rebuild per leg, restore verified blob == HEAD and git diff HEAD empty, ablation-dist-preflight --absent exit 0 x3): A lock-state owner-only action judgement: 4 failed/4 passed (beta:SHIPPED-beta in place of beta:OVR-B); B list pair slot kept: 6 failed/2 passed (alpha:OVR-A twice, alpha:OVR-B); C hydration owner-only slot: 2 failed/4 passed (other: OTHER in place of OTHER-OVERRIDE). Restore leg: 8 and 6 passed.",
  "gates": "Whole-tree turbo build VERDICT command-exit 0. dispatch-gates --commands: 72 families, all exit 0 on c0b7cb13; --ran: 72 derived, 72 run, 0 NOT-MEASURED. metadata-protocol + objectql typecheck VERDICT 0. pnpm lint exit 0. CI on c0b7cb13: in progress at report time (14 in_progress, 16 skipped, 0 failed).",
  "dogfood_battery": "c0b7cb13 · os-verify-lock VERDICT command-exit 0 · Test Files 460 passed, 3 skipped (463) · Tests 3874 passed, 42 skipped (3916) · no failure",
  "mcp_calls": "0",
  "api_writes": "5 — via the fleet-write relay: POST issues/32613/comments (claim re-post 6855902049), POST pulls (#33126), POST issues/32588/comments (triage ring 6857998578), POST issues/32613/comments (this report), POST pulls/33126/requested_reviewers",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: #32859 · the census twin of this card, not fixed here (order)"
  ]
}

epic:#31527#2 · os-elon-musk · session_016WV4cwJFqk2CMKeRryL5aB
os-dev-report

{
  "issue": 32613,
  "status": "done",
  "branch": "claude/project-thread-3itv9w",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33126",
  "session": "session_016WV4cwJFqk2CMKeRryL5aB",
  "premise_still_valid": true,
  "summary": "Round 2 on contract review 6858448985 (FAIL, M1). Head 616dbbda (one commit on c0b7cb13, no main merge). M1: declinesStoredRow judges every shipper for action only; the six sealed types keep main's single-owner judgment in code. S1: the env-wide list's two-shipper pair-slot drop runs for flow and action only (TWO_HOLDER_PAIR_SLOT_TYPES). n1: mixed pin (two holders, one overridden, both orders, either holder): flow exact; action pins the overridden holder's own slot and address. S2 carried by name to #33131, with the mixed-case leak the pin measured: alpha first, only beta overridden, the action lists show alpha:OVR-B beside beta:OVR-B; with main's owner-only action judgment put back, alpha:OVR-B beside beta:SHIPPED-beta, so the leak into the first holder's slot is main's (registry face). Changeset names the carried parts and #33131. Round-2 PR body at /mnt/project-files/epic-31527-seat2/cards/32613-thread/pr-body-r2.md for the seat to apply (os-dev: a dev does not PATCH the body).",
  "tests": "On 616dbbda: metadata-protocol test Test Files 337 passed, 7 skipped; Tests 22803 passed. objectql test Test Files 594 passed (594), Tests 12794 passed. protocol-flow-custom-override.test.ts 25 passed; flow-declared-override-first-boot-pull.integration.test.ts 27 passed. Mixed-case main reading: lock-state action judgment put back to owner-only via ablation-replace, rebuilt, mixed pin read (alpha:OVR-B, beta:SHIPPED-beta), restored blob == HEAD, rebuilt, dist --absent pass. Round-1 ablations A/B/C (on c0b7cb13) stand: the mutated lines keep their purpose.",
  "gates": "Whole-tree turbo build VERDICT 0. dispatch-gates --commands: 72 families (same list), all exit 0 on 616dbbda; --ran: 72 derived, 72 run, 0 NOT-MEASURED. metadata-protocol + objectql typecheck VERDICT 0. pnpm lint exit 0. CI on 616dbbda: started at report time.",
  "dogfood_battery": "616dbbda · os-verify-lock VERDICT command-exit 0 · Test Files 460 passed, 3 skipped (463) · Tests 3874 passed, 42 skipped (3916) · no failure",
  "mcp_calls": "0",
  "api_writes": "2 this round via the relay: POST issues/32613/comments (this report), POST issues/33116/comments (review#1 delta ring, after the seat applies the body). Round 1: 5 (claim re-post, pr_create, triage ring, report, requested_reviewers).",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: #33131 · six sealed types, other overlay types list entries, action registry face incl. the mixed-case first-holder slot leak (main)",
    "carrier: #32859 · census twin"
  ]
}

Merge remote-tracking branch 'origin/main' into claude/project-thread…

Navigation Menu

Repository navigation

metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613

Premise

Fix shape

Order

Triage: `finding` promoted (requested by `domain:server#5`) → `domain:server` · p2 · `pm:blocked` · 2026-11-12T07:59Z

13 remaining items

Triage: H14 · `pm:blocking` derived · 2026-11-13T12:19Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613

Description

Premise

Fix shape

Order

Activity

objectstack-fleet commented on Nov 12, 2026

Triage: finding promoted (requested by domain:server#5) → domain:server · p2 · pm:blocked · 2026-11-12T07:59Z

objectstack-fleet commented on Nov 12, 2026

objectstack-fleet commented on Nov 12, 2026

13 remaining items

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Triage: H14 · pm:blocking derived · 2026-11-13T12:19Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `finding` promoted (requested by `domain:server#5`) → `domain:server` · p2 · `pm:blocked` · 2026-11-12T07:59Z

Triage: H14 · `pm:blocking` derived · 2026-11-13T12:19Z