client: meta.getHistory, rollbackItem and diffItem cannot name a package, so a two-holder item's history is unreachable through the SDK (ADR-0150 D3, after #32905) #33310

epic:#31527#3 · os-tesla · session_01L9qibvyhxPWfA8DsbmVYJ5

Filing gate ①: a product defect with named landing points, owed by PR #33193 (#32905), which scoped it out. Reach: a public entry (the published @objectstack/client SDK), read from the code; the 409 it runs into is measured in PR #33193's dogfood pins.

Parent: #32905 (source card). Found by: contract review 6880527562 on PR #33193 ("Follow-ups without a card … need a card before merge"). Twin of #23658 (meta.publishItem could not name a package).

• Why: a developer or agent scripting against the SDK reads or rolls back a flow, agent, skill or other per-package item that two packages hold. After PR fix(metadata-protocol)!: history and rollback doors refuse a bare two-holder name and address one holder by ?package= #33193 the server answers a bare request 409 and names ?package= as the remedy, but the SDK methods have no way to send it, so the remedy is unreachable through the SDK and the caller is stuck without hand-building URLs.
• Reader: the server lane's next seat on the epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 line, after PR fix(metadata-protocol)!: history and rollback doors refuse a bare two-holder name and address one holder by ?package= #33193 lands.
• Duplicate search (issues, open and closed, 2026-11-14): is:issue diff history package holders 139 hits, is:issue getHistory package 18, is:issue history rollback action two shippers 2. The only open hits on this surface are console + rest: the History item tool reads and rolls back by the bare name, so a name two packages hold in a type stored per package cannot be read or rolled back from the console (ADR-0150 D3/D4) #32905 (the source card), objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 and design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 (the epic); metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351 (closed) made the manager path package-aware and client: meta.publishItem cannot name a package, so the ?package= remedy that PR #23654's narrowed publish answers name is unreachable through the SDK (#23293's twin) #23658 (closed) is the publish twin of item B. None covers this item.

Landing points

packages/client/src/index.ts:

• meta.getHistory(type, name, { sinceSeq, limit }) (about line 2283) sends no package.
• meta.rollbackItem(type, name, toVersion, { message }) (about line 2668) sends no package.
• meta.diffItem(type, name, { from, to }) (about line 2682) sends no package (the door itself is the sibling card for the diff door).
• A second getHistory near line 8776 should be read for the same gap.

The console does not use these (it calls ui/packages/data-objectstack's history/rollback, which PR #33193 already extends with packageId).

Expected

Each method takes an optional packageId and sends it as ?package= (the spelling the /layers and plain reads use), as #23658 did for publishItem and #31695 for getItem. Pins: the URL carries package when given and is unchanged when not.