metadata-protocol: bare history and rollback of an action two packages ship answer 200 empty and 404 where the bare read answers 409 (ADR-0150 D4, after #32905) #33311

epic:#31527#3 · os-tesla · session_01L9qibvyhxPWfA8DsbmVYJ5

Filing gate ①: a product defect with a named landing point and a measured wrong answer over HTTP, owed by PR #33193 (#32905), which reported it and scoped it out (its changeset says so).

Parent: #32905 (source card). Found by: PR #33193's measurement (PR body, "Gap reported, not fixed here") and contract review 6880527562 ("Follow-ups without a card … need a card before merge").

• Why: an admin opening the history of an action two packages ship gets an empty timeline, and a rollback answers "version not found", where the plain read of the same name tells them two packages hold it and how to name one. The empty answer reads as "this action has never changed" and hides the ambiguity; an agent following it concludes there is nothing to restore.
• Reader: the server lane's next seat on the epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 line, after PR fix(metadata-protocol)!: history and rollback doors refuse a bare two-holder name and address one holder by ?package= #33193 lands.
• Duplicate search (issues, open and closed, 2026-11-14): is:issue diff history package holders 139 hits, is:issue getHistory package 18, is:issue history rollback action two shippers 2. The only open hits on this surface are console + rest: the History item tool reads and rolls back by the bare name, so a name two packages hold in a type stored per package cannot be read or rolled back from the console (ADR-0150 D3/D4) #32905 (the source card), objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 and design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 (the epic); metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351 (closed) made the manager path package-aware and client: meta.publishItem cannot name a package, so the ?package= remedy that PR #23654's narrowed publish answers name is unreachable through the SDK (#23293's twin) #23658 (closed) is the publish twin of item B. None covers this item.

Measured (reach: HTTP)

Artifact boot of the #31697 fixture: two packages shipping qa_shared_digest object-less and qa_shared_bound each on its own object, no stored row.

Landing point

historySlotOf (packages/metadata-protocol/src/protocol-history-slots.ts, added by PR #33193) judges a bare name by its row slots and the registry's resolveItem only. The bare plain read of an action also runs refuseAmbiguousObjectLessAction and judgeBareActionRead, which the history doors do not ask.

Expected

The bare history and rollback doors refuse where the bare plain read refuses: 409 naming both shippers for an action name two packages ship, with or without a stored row. A one-shipper action keeps working bare (CONTROL). The pin belongs beside PR #33193's SHIPPED_NONE dogfood case (packages/qa/dogfood/test/history-rollback-two-holders.dogfood.test.ts).