metadata-protocol: the history diff door compares two package holders' versions of one name as if they were one item's (ADR-0150 D4, after #32905) #33308

epic:#31527#3 · os-tesla · session_01L9qibvyhxPWfA8DsbmVYJ5

Filing gate ①: a product defect with a named landing point and a measured wrong answer over HTTP, owed by PR #33193 (#32905), which scoped it out.

Parent: #32905 (source card). Found by: the measurement on #32905 (step 1, section A) and contract review 6880527562 on PR #33193 ("Follow-ups without a card … need a card before merge").

• Why: an admin comparing two versions of a flow, agent or other per-package item that two packages hold gets a diff of one package's version against the other package's version, presented as one item's change. They read it to decide what a rollback will restore, so a wrong diff leads them to restore the wrong body. PR fix(metadata-protocol)!: history and rollback doors refuse a bare two-holder name and address one holder by ?package= #33193 makes history and rollback answer per holder (?package=, bare 409); the diff door is the last door of the family that still reads across holders.
• Reader: the server lane's next seat on the epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 line, after PR fix(metadata-protocol)!: history and rollback doors refuse a bare two-holder name and address one holder by ?package= #33193 lands.
• Duplicate search (issues, open and closed, 2026-11-14): is:issue diff history package holders 139 hits, is:issue getHistory package 18, is:issue history rollback action two shippers 2. The only open hits on this surface are console + rest: the History item tool reads and rolls back by the bare name, so a name two packages hold in a type stored per package cannot be read or rolled back from the console (ADR-0150 D3/D4) #32905 (the source card), objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 and design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 (the epic); metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351 (closed) made the manager path package-aware and client: meta.publishItem cannot name a package, so the ?package= remedy that PR #23654's narrowed publish answers name is unreachable through the SDK (#23293's twin) #23658 (closed) is the publish twin of item B. None covers this item.

Measured (reach: HTTP)

Showcase boot (bootShowcase, packages/qa/dogfood) at 47f6c939, two packages com.qa.hist.alpha and com.qa.hist.beta each shipping flow qa_hist_shared, each edited twice in its writable pair (versions 1 and 3 alpha's, 2 and 4 beta's):

It writes nothing, so it is not a data-loss defect, but the answer is wrong.

Landing point

diffMetaItem (packages/metadata-protocol/src/protocol-diff-delete-load.ts) reads sys_metadata_history by (type, name). The door (GET /meta/:type/:name/diff, packages/rest/src/meta-item-history-routes.ts) takes no package.

Expected

The same rule PR #33193 gives history and rollback (historySlotOf, packages/metadata-protocol/src/protocol-history-slots.ts): ?package=P diffs only the addressed slot's versions and refuses a version another holder owns; a bare request for a name two slots hold answers 409 naming both; a one-holder name keeps working bare; ?package= on a type not stored per package answers 400. The console's diff view (if it calls the door) names the package where it names it for history.