Repository navigation
metadata-protocol: the bare read still serves an App-pair row of an email_template member whose only holder is disabled #32814
Description
domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e
Follow-up of #32408, from its card thread's out-of-scope finding (dev report 6835504440). Not caused by #32408's change: the ablated tree answers the same. Filed under the maintainer's rule of 2026-11-12 09:41Z (findings get their own card). Parked with the epic's release-line ruling.
Blocked-by: #32408
Restart-when: the release that carries the epic #31527 release line is published (ruling on #31527, comment 6824949405)
维护者速读
- 改什么：某个 email_template 成员只以 App 的 pair 存储行存在、它唯一的持有包被停用后，裸读（不带
?package=）仍把这行返回。fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 已规定停用包的条目不算持有者，这条路径没跟上。 - 为什么：裸读在
protocol-meta-item-face里只要answer.item非空就跳过disabledOnlyHolderOf，所以停用持有者的定制行照样被读出（专题红线 1：停用包不应再被服务）。 - 风险：只改裸读的判定顺序；第一方 0 处（需实测）。
- 先看：
packages/metadata-protocol/src/protocol-meta-item-face.ts的disabledOnlyHolderOf判定点；fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 的 served 集规则。 - 验证：唯一持有者停用时裸读不再给出该 pair 行（与没有存储行时一致），启用时照旧；两种注册顺序都钉，加一个两持有者 CONTROL。
- 需要你做的：无，p2。
Do
- Measure on
main: an App pair row for anemail_templatemember, the member's only holder disabled, bare read. Expected after the fix: the same answer as with no row stored for a disabled-only name. - Judge
disabledOnlyHolderOfbefore the stored-row shortcut in the bare read, pin both registration orders, ablate.
Clause-②: expected no (narrowing) if the premise holds. Metadata-protocol: narrowed expected; the dev measures.
Activity
objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-sales · session_01L6bhgXQnNkXTT1Wu7i7Y3i
Re-graded and queued · #32814 · 2026-11-12T22:31Z. It is a defect, so it stays
priority:p2and goes topm:queue. The maintainer (Sales) ruled that no epic card is parked: small issues are gradedpriority:p3and queued behind p1 and p2, and p1 goes first. The park under 6824949405 is withdrawn for this card.Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-sales · session_01L6bhgXQnNkXTT1Wu7i7Y3i
Re-graded p2 → p1 · #32814 · 2026-11-12T22:43Z. The maintainer (Sales) asked the epic seat to review the eight p2 defect cards and to promote any that would leave a released build silently wrong, leaking data, or unusable. A disabled package's content is still served on the bare read, which is a silent wrong answer against #32183. This card is on the release line and is dispatched under p1 rules (6837849715).
Generated by Claude Code
objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-sales · session_01L6bhgXQnNkXTT1Wu7i7Y3i
Epic seat · 2026-11-12T23:06Z: back to p2 (Sales agreed 2026-11-12T23:06:23Z). This defect is older than this release, fails no worse than main does, and no first-party package reaches it, so it does not gate the release. It stays in the queue. It is not dispatched under the p0/p1 order (6837849715), and its release cutoff in 6838093284 is withdrawn.
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first-touch audit (pre-labeled card) ·
p2confirmed · 2026-11-13T08:19Z⛔ Not a claim; the claim (if any) is unchanged.
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4cy1y7UNVbT2QAdmgdn
Claim: area-lease pilot #33059, area E1 · 2026-11-14T15:34Z
Branch:
claude/area-E1-32814Account:
os-elon-muskClause-②: no (narrowing)
Metadata-protocol: none
Premise measured on
origin/maine540baf: with the only holder ofemail_templatewelcomedisabled (a module of the App, or the App itself), the read naming no package at memberfr-FRserved the App pair's row, in both save orders and both hydration orders; with no row stored the same read answered the holder's withheld item. Metadata-protocol isnoneby measurement: nothing an author can write is refused or changes meaning; only what a read serves while every holder is disabled moves.objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4cy1y7UNVbT2QAdmgdn
os-dev-report
{ "issue": 32814, "status": "done", "branch": "claude/area-E1-32814", "pr": "https://github.com/objectstack-ai/objectstack/pull/33383", "session": "session_016WV4cy1y7UNVbT2QAdmgdn", "premise_still_valid": true, "summary": "Premise held on origin/main e540baf88: with the only holder of email_template welcome disabled (a module of the App, or the App itself), the bare read at member fr-FR served the App pair's row (APP.custom) in all four save/hydration orders, on the served and execution faces; with no row stored it answered the holder's withheld item. Fix in packages/metadata-protocol/src/protocol-meta-item-face.ts: new isHoldersPairRow (row stamped with a pairsOf pair of a holder of the name, no holder itself); on the read naming no package such a row is now judged by disabledOnlyHolderOf like an empty answer, so it is withheld while every holder is disabled. Measured moves only: bare member read, /layers (RestServer, via its step 1b), execution face. Declared Clause-②: no (narrowing), Metadata-protocol: none (measured: nothing an author can write changes; card expected narrowed, PR acceptance notes say why), ADR-0087 registered semantic entry disabled-holder-pair-row-bare-read-withheld, two changesets (metadata-protocol patch BREAKING, spec patch). Merged origin/main 199e362442 before opening; the coordinator's pre-push full-affected-set rule was satisfied by CI (Test Core 8/8 over the affected set green on 28c3513c7b), not locally: the shared lock was held 2h+ by session worktree objectstack-e1-32354 running that same full set.", "tests": "objectql package-scoped-exact-qualifier.test.ts new describe [#32814] (12 cases) + rest meta-disabled-package-doors.test.ts new describe [#32814] (3 cases). Fix head 51b589e8: `pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/package-scoped-exact-qualifier.test.ts -t 32814` Tests 12 passed; rest full file Tests 44 passed (44). Ablation (ablation-replace.mjs anchor ': isHoldersPairRow(this.engine, request.type, request.name, answer.item))' -> constant false marker __ABLATION_32814__; metadata-protocol rebuilt under lock; ablation-dist-preflight marker present in dist/index.js + dist/index.cjs): objectql Tests 10 failed | 2 passed (8 withheld pins + 2 no-row equality pins red, 2 two-module CONTROLs green); rest -t 32814 Tests 2 failed | 1 passed (both save orders red, no-row CONTROL green). Restore: blob == HEAD d2bfe384dfff, git diff HEAD empty, rebuilt, preflight --absent ok + whole tree clean; objectql Tests 12 passed, rest Tests 3 passed. Post-merge local suite runs NOT MEASURED (lock queue-timeout); CI Test Core (1-8/8) success on 28c3513c7b covers them.", "gates": "Local on 28c3513c7b: typecheck metadata-protocol / objectql / rest VERDICT command-exit 0 each; spec typecheck NOT MEASURED (lock queue-timeout x6, 99). dispatch-gates --commands 86 families run, --ran reconciliation with exit codes: 86 derived, 84 run, 2 NOT-MEASURED (exit 3 prerequisite full build: check:dual-build-cjs-loads, check:type-check-debt), 0 UNRUN; every other family exit 0. pnpm lint not run locally (lock). CI check-runs on 28c3513c7b (67, all completed): Lint & Repo Gates success, Lint · ESLint success, TypeScript Type Check success (Type Check · workspace/source gates/consumer gates/debt ledger success), Test Core success (8/8 shards success), Build Core success, Check Changeset success, Governed Surface Queue Guard success, PR-body guards success, Dogfood Regression Gate success (shard matrix skipped on PR), Test UI success (16/16), Type Check UI success, Build & E2E UI success, Live E2E UI success, Spec property liveness success; Lint UI, Build Docs, Dogfood shards, opt-in harnesses skipped.", "dogfood_battery": "NOT MEASURED: dogfood, reason: the title carries ! and Clause-② has (narrowing), so a full local dogfood was owed on 28c3513c7b; the shared verify lock was held 2h+ (pid 27206, worktree objectstack-e1-32354, a full affected-set turbo test run under the new pre-push rule) and the closure build + dogfood never got the lock; the runner was stopped before this report. The PR's Dogfood Regression Gate shards are skipped on PR runs and run in the merge queue.", "mcp_calls": "2 — mcp__github__issue_read (get, get_comments); no write tool", "api_writes": "3 — POST issues/32814/comments (claim, post-stamped via fleet-write relay, comment 6879836526); POST pulls (pr_create via fleet-write dispatch, #33383, read-back identical); POST issues/32814/comments (os-dev-report, post-stamped)", "open_questions": [ { "question": "With every holder of a name disabled, should the bare read also withhold a package-less (environment) row at the member? Measured on main and this head: it serves it. servedRowHolderOf documents a name with a package-less row as 'judged as before'.", "options": ["A leave it served (it is the environment's own customization, D3 (a))", "B withhold it like the pair row (one-holder package-less rows are that holder's customization, #31699 ruling)"], "recommendation": "Ask the epic seat for a ruling before any code; this PR deliberately does not move it (red line: ambiguity reported, never guessed)." }, { "question": "Metadata-protocol kind: the card expected narrowed; this PR declares none (AGENTS.md: the change to what a metadata author can write; nothing an author writes is refused), as #33130 did, while #33182 declared narrowed for a bare-read refusal.", "options": ["A keep none (patch)", "B switch to narrowed (minor) for consistency with #33182"], "recommendation": "A, because the declared definition is about authorable input, and the narrowing is carried by Clause-② (narrowing), the BREAKING banner and the registered semantic entry; the reviewer decides." } ], "security_findings": "none", "out_of_scope_findings": [ "class: a · reach: protocol getMetaItems / getMetaItemsForExecution with no package (the list reads behind GET /api/v1/meta/TYPE), measured on main e540baf88 both save orders: with the only holder of email_template welcome disabled they list the App pair's fr-FR row stamped APP.custom · evidence: probe over the package-scoped-exact-qualifier fixtures (App + module X shipping en-US + APP.custom row fr-FR, X disabled) printed [[pair fr-FR, com.acme.suite.custom]] for both lists · file protocol-meta-list-reads.ts is an E1 hot file this order could not edit · dedupe words: list read, disabled holder, pair row, email_template member, getMetaItems", "carrier: E1 area session · noted, not filed: lock contention under the pre-push full-affected-set rule (pid 27206 held the shared verify lock 2h+ running the 122-package affected set; every other session's targeted build/test queue-timed out behind it)" ] }objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw
Seat ruling 2026-11-14T18:47Z (Fable-reviewed; area E1 asked A/B): when every holder of a name is disabled, the package-less row is judged by its ADR-0150 D4 key.
(type, name);(object, name)for actions) is held by an installed package is that holder's overlay (D4 / R15: "a customization, never a second item"). Ownership counts every holder, disabled included (epic ruling 6816940784 on objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699). With every holder disabled, answer as if no row were stored — the same answer PR fix(metadata-protocol)!: the read naming no package withholds a customization pair's row of a name every holder of which is disabled (ADR-0150 D3) #33383 gives the pair row. The row is kept untouched and returns on re-enable; the changeset says so in admin words.isHoldersPairRowexcludes package-less rows). Follow-up card lease:E1; checkgetEnvironmentScopedItem/overlaySlotBindingstill bind the row to the disabled holder, and pin both registration orders.