metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Follow-up of #32568 (PR #32741), filed on the epic red-line delta read 6835864200 (must-fix 2, epic ruling: PR #32741 does not heal it; a p1 card under #32568, on the release line). Also measured by the card thread (#32752 comment 6835724023) and the contract delta review 6835663323 (S4). The re-enable half of #32752's scope moves here; #32752 keeps the pre-heal bare read.

维护者速读

改什么：两个包 A、B 持有同名可覆盖条目（email_template、dashboard）时，B 停用期间做一次不带包的列表读，读侧回填把环境的无包行按 A 的外壳放进 A 的槽位；B 重新启用后不会重新回填，A 的 registry 槽位、带 A 的列表和执行列表都把环境行当成 A 自己的答出来。精确读不受影响（409 列出两者）。
为什么：违反专题红线 2（歧义被猜成某个持有者的）；直接读 registry 的地方（发送时的读取、带包列表、执行列表）会用错正文。main 上更糟：这行会落进第一个注册的持有者槽位，哪怕它已停用。
风险：要动包启用路径或回填的 heal 时机；第一方计数需实测。
先看：packages/metadata-protocol/src/protocol-registry-hydration.ts（soleHolderOf、heal walk），包启用路径，PR fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 的 [#32568] 停用持有者 pin。
验证：停用 B → 不带包列表读 → 启用 B 之后，A 的槽位、带 A 的列表、执行列表都答 A 自己的条目；两种注册顺序；email_template 与 dashboard；有消融。
需要你做的：无，p1，在发版线上。

Do

Reproduce on main after PR fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 merges: disable B; one unscoped list read; re-enable B; read getPackageScopedItem(type, name, A), the list scoped to A and the execution list for email_template and dashboard.
Heal on enable (or on any change of the served holder set): a package-less overlay row laid into a holder's slot while it was the sole served holder is withdrawn once a second holder is served again. Pin all three readers, both registration orders, and ablate.

Clause-②: expected no (narrowing) (a served answer that guessed a holder goes away). Metadata-protocol: narrowed expected; the dev measures.

Blocked-by: #32568

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Claim: PM loop · p1 on the release line, dispatched to this seat by the epic seat (#31527 order 6838093284); its blocker #32568 landed as PR #32741 (a888c5c9e) · 2026-11-13T00:03Z
Session: session_01L6bhgVaKJ9TPfXPRhdqx3e (seat); a card thread implements, and the claim amendment names its session and branch
Account: os-sales
Branch: named by the claim amendment (the card thread's harness branch, from origin/main at or after a888c5c9e)
Domain: domain:server
Seat: domain:server#1
File surface: packages/metadata-protocol/src/protocol-registry-hydration.ts (heal walk, soleHolderOf), the package enable path in packages/metadata-protocol/src/**, their tests, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/qa/dogfood/test/**, root .changeset/, and an ADR-0087 semantic entry under packages/spec/src/migrations/entries/semantic/ if the change is narrowed. ⛔ Not protocol-meta-item-face.ts (#32752 keeps the pre-heal bare read). Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default, effort: high for code and gates; contract review on the contract review tier in an isolated sub-agent at xhigh.
Clause-②: no (narrowing) — expected: a served answer that guessed a holder goes away; the dev measures
Metadata-protocol: narrowed
Responsibility: the registry slot of a holder after another holder of the same overlay name is re-enabled (objectstack) | the package-less overlay row hydrated while the other holder was disabled stays in the holder's slot, served as its own | every reader of the registry slot: send-time reads, package-scoped lists, the execution list; today
Thread-read: 6835864200
Premise: to be measured on origin/main at or after a888c5c9e (step 1 of the card).
Serial constraints cleared: #32568 landed. #32752 (pre-heal bare read, parked) stays on protocol-meta-item-face.ts.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Claim amendment to this seat's claim 6839611034 on #32820 · 2026-11-13T00:04Z:
Session: session_01L6bhgV84zNSi6HwSHmMU2c (card thread, the one that landed #32568; seat session session_01L6bhgVaKJ9TPfXPRhdqx3e)
Branch: claude/project-thread-pjmygu, restarted from origin/main a888c5c9e (the merge of PR #32741; the old branch held only merged history and was deleted on merge)
Everything else in the claim stands.

epic:#31527#1 · os-sales · session_01L6bhgXQnNkXTT1Wu7i7Y3i

Epic seat · 2026-11-13T00:43Z: lowered to p2 (Sales agreed 2026-11-13T00:41:49Z). This is older than the release (main is worse, and #32741 already improves it), the trigger is rare, and it involves no security. Work in flight finishes and lands as usual. It is off the 24h release line (6838093284).

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Release: paused under the maintainer's token-saving order of 2026-11-13 (relayed by the epic seat: p1 first, p2 only what is required). The work is kept, nothing is deleted, no PR is open.
Restart-when: the maintainer lifts the token-saving mode, or the epic seat re-dispatches this card
Resume-from: claude/project-thread-pjmygu@0637a5006f4ecfc0967fc4ca99ecbeb2a1d4d7e2

State: fix, 9 pins, ablations, changeset and ADR-0087 entry done; main 919a781 merged; gates 88 run, check:dual-build-cjs-loads exit 3 (precondition, not investigated); dogfood not run; PR body draft r1 exists. Two findings for the next claimant: a holder installed (not re-enabled) after the heal keeps the residue (needs objectql registry.ts, outside this card's surface); the remedy must delete the package-less row before saving the holder's .custom override, and a save with ?package=<holder> on a code package answers 403. pm:dispatched → pm:on-hold, os-sales unassigned; the next claimant resumes from the branch above (merge main, never rebase).

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:19Z

⛔ Not a claim; the claim (if any) is unchanged.

Line: readers of two-holder overlay types after a disable/re-enable · registry slot, scoped list, execution list · rare · measured
Why: Maintainer-set: lowered to p2 with Sales' recorded agreement (2026-11-13T00:41Z); grade kept.
Rule: the card was filed already carrying a grade and state and had no triage audit; this is that audit, under the adopted grading rules (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997).

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Back to queue · 2026-11-13T11:39Z · pm:on-hold → pm:queue, on the maintainer's word relayed by the coordinator (「两张暂停的交回队列」, 2026-11-13 11:38Z). Supersedes the pause in Release 6840769895; no claim stands and no one is assigned.

Resume-from: claude/project-thread-pjmygu@0637a5006f4ecfc0967fc4ca99ecbeb2a1d4d7e2 (patches also saved at /mnt/project-files/issue-32820/patches)

Done: the fix, 9 pins with ablations, the changeset and the ADR-0087 entry; main 919a781b9 merged; 88 gates run; PR body draft r1 exists.
Left: merge main once (never rebase; spec: the #32568 upgrade-guide entry's remedy (1) deletes the user's own override if followed in the written order, and its ?package=<holder> save answers 403 on a code package #32968's remedy-order text has since landed as 152b53c77, so re-read this card's entry against it), find why check:dual-build-cjs-loads exits 3 (a precondition, not investigated), one dogfood run, the draft PR through the relay pr_create, contract review through triage (pm:mailbox — triage#1 · hotlong #32588).
Findings for the next claimant: a holder installed (not re-enabled) after the heal keeps the residue, which needs objectql registry.ts outside this card's surface; the accepted remedy deletes the package-less row before saving the holder's .custom override.
The 18.4.0 merge freeze ([sweep] v18.4.0 release test sweep #32908 6848983225) holds changeset PRs out of the queue until chore: version packages #29963 merges.

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Claim: PM loop round 3 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; its serial predecessor #32613 landed as PR #33126 (840372560a) · 2026-11-13T18:24Z
Session: session_016WV4czFhtRVZNBeHdQA6PW
Account: os-elon-musk
Branch: provisional — the card thread re-posts this claim with its own claude/project-thread-* branch, resuming from claude/project-thread-pjmygu@0637a5006f4ecfc0967fc4ca99ecbeb2a1d4d7e2 (Resume-from 6840769895; the branch ref is gone, the sha is fetchable)
Worktree: objectstack-issue-32820
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6839611034: packages/metadata-protocol/src/protocol-registry-hydration.ts (heal walk, soleHolderOf), the package enable path in packages/metadata-protocol/src/**, their tests, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/qa/dogfood/test/**, root .changeset/, and the ADR-0087 semantic entry. ⛔ Not protocol-meta-item-face.ts. Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility: platform code in objectstack (the registry slot of a holder after another holder of the same overlay name is re-enabled); no other platform path covers it; reached by every reader of that slot (send-time reads, package-scoped lists, the execution list)
Thread-read: 6851761213
Premise: holds (carried from the earlier claim and the work on the branch; the thread re-reads every comment first)
Serial constraints cleared: #32613 (shared protocol-registry-hydration.ts) merged as PR #33126

epic:#31527#2 · os-elon-musk · session_016WV4d1H7jxfU2FWB3HDdbs

Claim: PM loop round 3 · p2 with a pushed branch, resumed on the maintainer's order 「31527 之前已经开发了分支的 p2，继续推进到合并」; its serial predecessor #32613 landed as PR #33126 (840372560a) · 2026-11-13T18:31Z
Session: session_016WV4d1H7jxfU2FWB3HDdbs (card thread; seat session session_016WV4czFhtRVZNBeHdQA6PW)
Account: os-elon-musk
Branch: claude/project-thread-h7ti0h, resumed from sha 0637a5006f4ecfc0967fc4ca99ecbeb2a1d4d7e2 (Resume-from 6840769895), origin/main bf02d33b merged once (no rebase)
Worktree: objectstack-issue-32820
Domain: domain:server
Seat: epic:#31527#2
File surface: as claim 6839611034: packages/metadata-protocol/src/protocol-registry-hydration.ts (heal walk, soleHolderOf), the package enable path in packages/metadata-protocol/src/**, their tests, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/qa/dogfood/test/**, root .changeset/, and the ADR-0087 semantic entry. ⛔ Not protocol-meta-item-face.ts. Stop on breach; explain in the report.
Container & model: M, mode:thread, model: default (no path-derived mandate), effort: high
Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility: platform code in objectstack (the registry slot of a holder after another holder of the same overlay name is re-enabled); no other platform path covers it; reached by every reader of that slot (send-time reads, package-scoped lists, the execution list)
Thread-read: 6861459277
Premise: holds (carried from the earlier claim and the work on the branch; every comment on this card re-read by this thread)
Serial constraints cleared: #32613 (shared protocol-registry-hydration.ts) merged as PR #33126

epic:#31527#2 · os-elon-musk · session_016WV4d1H7jxfU2FWB3HDdbs

os-dev-report

{
 "issue": 32820,
 "status": "done",
 "branch": "claude/project-thread-h7ti0h",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/33149",
 "session": "session_016WV4d1H7jxfU2FWB3HDdbs",
 "premise_still_valid": true,
 "summary": "Resumed from 0637a500 (Resume-from 6840769895), merged origin/main bf02d33b once (no conflict; #33126's edit of the same file sits in a different branch of hydrateOverlayIntoRegistry). The fix rebuilds, on the registry's enable notice, a package-less overlay row the hydrator laid into the one served holder's slot, for the holders served then; an entry another write replaced is left alone. One new commit 1484f1cd aligns the ADR-0087 entry's remedy and the changeset's FROM -> TO with the landed remedy order (152b53c77): keep the row's body and clear bound rows before the package-less delete. Draft PR #33149 opened via the relay; contract review rung to review#1 (mailbox #33116, 6863438812).",
 "tests": "On merged head: objectql src/package-scoped-exact-qualifier.test.ts 252/252; metadata-protocol call-site censuses 11/11; metadata-protocol test + typecheck exit 0; objectql test + typecheck exit 0; spec src/migrations tests + typecheck exit 0. Ablations (fix committed first, ablation-replace.mjs, metadata-protocol rebuilt each leg, dist preflight marker present then --absent): heal listener no-op -> [#32820] 7 failed / 2 passed ('B enabled: expected { slot: env row } to deeply equal { slot: alpha own }'); identity guard never true -> 1 failed / 8 passed (the later-write CONTROL, Object.is). Restores: blob == HEAD, git diff HEAD empty, tree clean.",
 "gates": "head 1484f1cd: full build 120/120; dispatch-gates --ran: 89 derived families, 89 run, 0 NOT-MEASURED (check-plugin-teardown-shape --self-test first exit 3 on the shallow clone, its pinned control commit 621a4876 fetched, then exit 0; check:dual-build-cjs-loads exit 0 after the full build; check:type-check-debt exit 0); pnpm lint exit 0. CI check-runs on PR #33149: in_progress at report time.",
 "dogfood_battery": "1484f1cd · os-verify-lock VERDICT command-exit 0 · Test Files 460 passed | 3 skipped (463) · Tests 3886 passed | 42 skipped (3928) · no failures",
 "mcp_calls": "0",
 "api_writes": "4 — relay: comment #32820 (claim re-post 6861622989), pr_create (#33149), comment #33116 (review#1 ring 6863438812), comment #32820 (this report)",
 "open_questions": [],
 "security_findings": "none",
 "out_of_scope_findings": [
  "carrier: none · a holder INSTALLED (not re-enabled) after the hydration that ships the name keeps the package-less row in the other holder's slot until the next unscoped hydration; no registry notice reaches the protocol for a new holder, the fix needs packages/objectql/src/registry.ts outside this card's surface; stated in the changeset's Not changed and the PR's Carried section"
 ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled #32820

维护者速读

Do

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:19Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled #32820

Description

维护者速读

Do

Activity

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Triage: first-touch audit (pre-labeled card) · p2 confirmed · 2026-11-13T08:19Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit (pre-labeled card) · `p2` confirmed · 2026-11-13T08:19Z