[objectstack-fleet]

Fixes #32355
Clause-②: no (narrowing)
Metadata-protocol: none
Skills-docs: none — no published skill teaches a job pull, or a manifest-less input to a composeStacks(…, { manifest: 'preserve' }) composition

维护者速读

• 改了什么:多包制品里,若顶层残余(无 manifest 的输入)的 job 与某个包体的 job 同名,该 job 的 pull 不再被按名字归给那个包体,而是在任何调用或写入之前以 409 拒绝,并点名包体与残余两方。
• 为什么改:改前,残余的 job 会以那个包体的身份(callerPackageId)去拉取、读那个包的映射,这是"凭名字猜"的归属,违反 ADR-0150 D3。
• 风险与回滚:属于收窄(BREAKING,第一方计数 0:没有第一方 job 声明 pull)。回滚即 revert 本 PR;唯一受影响的写法是同名 job 横跨包体与顶层残余,改名即可。
• 先看:packages/runtime/src/app-artifact-handlers.ts 的 jobDeclaringPackages(按计数识别残余同名,residualCarries 分支)与 jobNameRefusal 的残余措辞;再看测试文件末尾的 [#32355] describe。
• 两分钟验证:pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 src/app-artifact-handlers.job-pull.test.ts -t 32355,预期 5 个用例全绿。
• 需要你做的:无,席位落地。

What changes

FROM → TO. FROM: in an artifact loaded from JSON, a top-level job that no package body declares (the ADR-0130 residual, emitted by composeStacks(…, { manifest: 'preserve' }) for an input with no manifest) and that shares its name with exactly one body's job was matched to that body by name, so its pull ran as that body's package (callerPackageId) and read that package's mappings. TO: such a name answers no package; each run is refused before any call or write, 409 RESOURCE_CONFLICT (ambiguous-in-environment), naming the declaring body and the residual, reusing the two-body refusal shape. Exception, unchanged: when the residual's own package (the body that carries the artifact's id) IS the one declaring body, the name answers that package. Fix for an author who hits it: rename the top-level job, or the body's, so each job name has one declaring holder.

On a JSON-loaded artifact the body's own job of that name is refused too, including where it used to pull correctly as its body: nothing in the artifact tells the body's flattened copy from the residual's job.

• jobDeclaringPackages recognises the residual twin by COUNT: the binder's jobs hold more jobs of the name than the bodies declare (the flattened top level copies each body job once). Never by comparing a copy's content with its body's.
• jobNameRefusal takes an optional residual holder and names it, as its owning package when a body carries the artifact's id (then also a candidate), else as the top level that names no package.
• The job binder's caller is unchanged apart from one comment line: it already throws the refusal jobDeclaringPackages answers.

Step 0: can the shape boot? Yes, measured

• Build door. os build on a real config composing a module body with a sync pull job, a manifest-less stack with its own sync pull job, and an app body: exit 0, ✓ Build complete. The artifact's top-level jobs is [["sync","alpha_map"],["sync","host_map"]], the bodies [["com.example.alpha",["sync"]],["com.example.beta",[]]], manifest.id com.example.beta. Nothing in the build refuses the pair: the same-stack duplicate check (collectDuplicateEntryErrors) runs per input stack and does not read the composition. The probe config was temporary and is not in the diff.
• Job-service key. Both copies key under the one name for the one app (jobKeyFor), and every shipped adapter replaces on a duplicate key (CronJobAdapter.schedule and IntervalJobAdapter.store cancel first). So the key does not prevent the shape. It collapses the pair to the LATER job in top-level order, which on the build's own order is the residual's.
• Earlier gates. judgeJobPull binds (the residual's mapping is at the top level), and jobs are not registered as metadata items (TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL), so no registry refuses the pair first.
• The defect, live. With the fix ablated, the pin on a real CronJobAdapter records the surviving run pulling { mapping: 'host_map', callerPackageId: 'com.example.alpha' }: the residual's mapping, pulled as the body that declares the name.

Census: 0 first-party pairs. The one first-party preserve composition (examples/app-multi-package) gives every input a manifest and declares no jobs, and no first-party job declares a pull.

Tests

packages/runtime/src/app-artifact-handlers.job-pull.test.ts, a top-level describe in the existing job-pull harness file. The runs go through a real CronJobAdapter (@objectstack/service-job), so which job of the pair survives is the job service's answer, not the test's:

1. The artifact composeStacks emits, through JSON, carries the pair (the body's copy and the residual's own job).
2. JSON-loaded, on the real job service: both are scheduled under one key, no pull is asked for, and the one surviving run fails 409 RESOURCE_CONFLICT naming both packages. jobDeclaringPackages answers the refusal for every job of the name, and names a residual that has no package.
3. Control: the residual's owner IS the one declaring body. The name answers that body, and the run pulls as com.example.alpha.
4. Controls: a residual job with a name of its own binds as before (its owner, or no package), a body job with no residual twin binds to its body, and only the shared name is refused. Each pull carries the trigger: 'manual' that CronJobAdapter.trigger() hands and the binder forwards, and no jobRunId, because that adapter writes no run row.
5. Fail-closed: a disabled (enabled: false) twin on either side still refuses the name. Every job of the name answers the refusal, the enabled one is scheduled, and its run fails 409 before any pull.

Ablation, once, on 38ef518bc2. The anchor if (residualCarries.has(name as string)) { was replaced with if (false && …) through scripts/ablation-replace.mjs (anchor 1 → 0, blob 6d43531fdb28 → 74e26a44a08b). Pins 2 and 4 went red, 2 failed | 2 passed. Pin 2's diff shows the pre-fix pull of host_map as com.example.alpha. After the restore (blob == HEAD, git diff HEAD empty) the four pass. The source is imported relatively from src, so no dist/ is involved.

Acceptance notes

• The job service holds one job per (app, name), so a job name the residual and a body share also drops one of the two jobs. Which one is dropped depends on the top-level order. That is outside this card's file surface and is not changed here. The refusal names both holders, and the author's fix (a rename) clears both.
• An artifact WITHOUT the flattened half that still carries a residual job of a body's name cannot come out of the compiler: the emitter keeps the flattened half whenever the bodies do not reproduce it item for item. On a hand-written one, resolveArtifactCollections lets the top-level name claim the body's job, and the count sees one job of the name. That reader behaviour is not changed here.

Verification

The PR head is bd92690d4e. It merges origin/main three times over the work commits, the last time at 5467af4325, which brought in #32405 (the job runId/trigger forwarding), plugin-security, spec and service-analytics. Every reading below is on bd92690d4e. After it, main moved again by one commit, which was not merged in: the merge queue tests the merged state.

Runtime suite and typecheck, under the shared verify lock

job-pull file: Tests 43 passed (43)
pnpm --filter @objectstack/runtime typecheck  -> TYPECHECK_OK
pnpm --filter @objectstack/runtime test
 Test Files  581 passed (581)
      Tests  9757 passed | 19 skipped (9776)
os-verify-lock: VERDICT command-exit 0

Dogfood battery, under the lock, the same command CI runs (no shard, no path)

bd92690d4e (PR head): pnpm --filter '@objectstack/dogfood^...' build -> CLOSURE_BUILD_OK
                      pnpm --filter @objectstack/dogfood test
 Test Files  451 passed | 3 skipped (454)
      Tests  3775 passed | 42 skipped (3817)
os-verify-lock: VERDICT command-exit 0

Lint and derived gate families

• eslint --no-inline-config on the two changed .ts files: exit 0.
• node scripts/pm/dispatch-gates.mjs --commands derived 65 families, run on bd92690d4e. 63 exited 0. 2 exited 3 (PREREQUISITE NOT MET, so NOT MEASURED locally, and CI's Lint & Repo Gates runs both): check:dual-build-cjs-loads needs a full pnpm build, and check:type-check-debt never got the verify lock to re-measure. --ran reconciliation: 65 derived, 65 run, 0 UNRUN.
• Changeset: .changeset/32355-residual-job-twin-refused.md, @objectstack/runtime: patch, BREAKING banner, both declaration lines, ADR-0087 disposition not-required (no-migration-prescription). check-adr-0087-registration, check-changeset-no-major and check-empty-changeset all exited 0.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 29 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b96d492db8641c7d8b16ee9f95babec879ceafac → packageMentionDocs.

Which tree this was computed on

This run read content/docs from b71c175d2be956cfcffa5dfcea8837762eb94773 — the merge of head bd92690d4e38d3ee2df33005003f1f3edbd7210c into base b96d492db8641c7d8b16ee9f95babec879ceafac, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin b71c175d2be956cfcffa5dfcea8837762eb94773 && git checkout b71c175d2be956cfcffa5dfcea8837762eb94773
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b96d492db8641c7d8b16ee9f95babec879ceafac bd92690d4e38d3ee2df33005003f1f3edbd7210c && git checkout -B drift-repro b96d492db8641c7d8b16ee9f95babec879ceafac && git merge --no-ff bd92690d4e38d3ee2df33005003f1f3edbd7210c

node scripts/docs-audit/affected-docs.mjs --json b96d492db8641c7d8b16ee9f95babec879ceafac

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Epic red-line read of #31527 for #32410 (#32355, the residual-twin job refusal), at head 33c3ec4f · 2026-11-11T10:12Z.

Verdict: the red lines hold, but no PASS yet. One must-fix is owed before landing: the head predates #32405, and one of this PR's pins will go red on the merged tree. One should-fix is carried as a card, and there is one nit.

I read the net diff against origin/main (3 files, +236 / −6), the PR body, the changeset, card #32355 and its thread, the #32071 / #32294 record, ADR-0150 on origin/main, and the epic body with its rulings. Nothing was built or run. This is not the contract review, which judges the narrowing itself and stays owed before ACCEPT.

1. ADR-0150 D3 and D4: agrees

• D3, never by name alone. A job name that a body declares and the residual also carries now answers no package. The run is refused before any call or write, unless the residual's owner IS the one declaring body. No path left in jobDeclaringPackages gives a residual twin to a body by its name.
• Detection is by count, and it matches the reader. resolveArtifactCollections takes the top level whole and adds only what it did not claim. So on the artifact the compiler emits, more bound jobs of a name than the bodies declare is exactly a top-level job of its own. A miscount in the other direction (a body resolveArtifactPackageOrder does not admit) over-refuses, which is fail-closed.
• The hand-written, partly flattened artifact in the acceptance notes is the shape A multi-package artifact serializes its metadata twice — the flattened top level and every packages[i] body carry the same definitions #14512 ruled out, and artifact-collections.ts forbids a claim or fallback for it. Leaving it unchanged is correct. Nothing is owed.
• D4, holders. jobKeyFor and the per-package key are untouched.
• Refusal shape. It reuses fix(runtime, service-automation): a job's connector pull reads its mapping from the package that declares the job (ADR-0150 D3) #32294's: PackageScopedNameRefusedError, 409 RESOURCE_CONFLICT, ambiguous-in-environment, callerPackageId: null, and candidates of kind: 'package'. That is the same PackageScopedRefusal the doors answer as details.candidates. One gap is S1 below.
• Red line 3. The narrowing is declared with FROM → TO, a BREAKING banner and a first-party census of 0. Step 0 measured that the shape boots, as the card asked.

2. Siblings: clean

• runtime: bind a multi-package artifact's hooks and functions per declaring body, as actions are after #32333 (ADR-0150 D3/D4) #32349 (hooks and functions per body, same file): untouched. The source diff is jobDeclaringPackages, jobNameRefusal and one comment line in the binder.
• runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411 (two same-name jobs collapse to one job-service key): correctly left out. It is a job-service key defect outside this card's surface, the PR body states it, and the owner-is-the-body control pins today's behaviour. The card is a sub-issue of design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527, pm:blocked, Blocked-by: #32410 (triage 6792817394).
• Nothing is half-done inside the card's three steps.
• sync-in P2 engine (epic #31763, ADR-0153): windowed and paged reads, committed position, delete marking, provenance, drift, sys_sync_run, organization scope #32062 slice 4 (feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405): not on this head. See M1.

3. Order: clear

• fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32327 (objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183) and feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214 (objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699) touch neither changed file. feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214's hunk in package-scoped-resolution.ts changes the type sets, not the refusal shape or the error class this PR reads.
• Carry-in for fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32327's read. This binder names declaring bodies from the artifact, not from the served set. With a disabled body the failure is an over-refusal naming it, which is fail-closed and the class already accepted as item 5 on feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214. Which job a top-level job is does not move with a reversible disable, so fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32327 should not make this count read the served set.

Owed items

• M1, must-fix: merge origin/main and move the controls pin. main is at b96d492d (feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405), 3 commits past this head. CI on this head merged base cbf40f85, which also lacks it.
  • The textual merge is clean (git merge-tree), and the merged binder keeps both: the declarerRefusal throw, then jobRunId and trigger forwarded.
  • On that tree CronJobAdapter.trigger() hands the handler trigger: 'manual', and the binder forwards it. The fourth pin (controls: a residual job with a name of its own…) asserts expect(pulls).toEqual([{ mapping, context, callerPackageId }, …]) on a real CronJobAdapter. By reading, each pull now also carries trigger: 'manual', so that pin fails in the merge queue.
  • Do: merge main, add trigger: 'manual' to the two expected pulls (no jobRunId, since CronJobAdapter writes no run row), re-run the job-pull file and the runtime suite on the new head, and correct the Verification paragraph's "two commits".
  • Pins 1 to 3 do not read the full pull, so they are unaffected.
• S1, should-fix, carried as a card (not this PR): a refusal with one candidate. When no body carries the artifact's id, candidates holds only the declaring body, and the residual is named in the message alone. A consumer reading candidates sees an ambiguous-in-environment refusal with one package and could take it as the answer. No PackageScopedHolder kind spells "the top level, no package", and adding one is @objectstack/core surface and ADR vocabulary, outside this card. Reach today is the job run's failure record only. The seat files it under design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 at landing.
• N1, nit. In the owner-is-another-body case the residual's owner appears in candidates as a plain package holder although its body declares no such job. The message says why. Leave it; S1's card settles the spelling.

Recorded for the ADR (Tier H, not this PR)

D3 says a job reads from "the job's package". It does not say what a top-level job outside every body is. The next amendment card should state: the residual's job runs as the body that carries the artifact's id, or as no package, and a name it shares with a body's job is refused (#32071, #32355).

---

Generated by Claude Code

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Rendered 2026-11-11T10:13Z by a contract-review subagent of the seat, narrowing face, read-only. Inputs: card #32355 (body, every comment, dev report 6792591092), this PR's body, file list and net diff against main, and the check-runs on the head (35 success, 16 skipped, 0 failed, read at render time).

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 33c3ec4f4724faaca42fcb68894e240637d9a78a
Local-runs: none
Scope: packages/runtime/src/app-artifact-handlers.ts, packages/runtime/src/app-artifact-handlers.job-pull.test.ts + packages/runtime/src/app-plugin.ts (collectBundleJobs), packages/runtime/src/artifact-collections.ts (resolveArtifactCollections), packages/core/src/artifact-packages.ts (resolveArtifactPackageOrder, artifactPackageId), packages/core/src/package-scoped-resolution.ts (PackageScopedRefusal, its reasons and holder kinds), packages/spec/src/stack.zod.ts (composeStacks, the jobs: 'concat' disposition, collectDuplicateEntryErrors, packagesCarryEveryInputCollection, packagesReproduceComposedCollections), packages/services/service-job/src/cron-job-adapter.ts and interval-job-adapter.ts (schedule cancels then replaces), docs/adr/0150 D3/D4 — all read in the cited code, none reviewed

① Derived judgments

Read in the tree at the head, not in the PR body.

1. Accept-set, narrowed — right. In an artifact that carries packages[], a job met by NAME (not by a body's own object) whose name a body declares, when the binder's jobs hold more jobs of that name than the bodies declare, now answers a PackageScopedRefusal (ambiguous-in-environment, type job), and its run throws PackageScopedNameRefusedError (409 RESOURCE_CONFLICT) before the pull is asked. Before, it answered the one declaring body and pulled as it. The throw sits where fix(runtime, service-automation): a job's connector pull reads its mapping from the package that declares the job (ADR-0150 D3) #32294's two-body refusal already sat (scheduleAppArtifactJobs, one comment line added there), so no new door and no new code is minted (ADR-0150 D5).
2. The refusal covers BOTH jobs of the name, not the residual's alone — right, and worth saying out loud. On a JSON-loaded artifact neither top-level sync is any body's object, so both are met by name and both answer the refusal (pin 2 asserts it for every job of the name). That includes the body's own copy, which pulled correctly as its body before whenever it was the survivor of the one key. Nothing in the artifact tells the copy from the residual's job, so refusing both is the only answer that guesses nothing. See nit N1 for the prose.
3. The one exception — right. declarers.length === 1 && declarers[0] === residual answers that package. The residual registers under manifest.id (stack.zod.ts, the residual rule), so when a body carries that id the residual's job and the body's job are one package's two jobs of one name: one holder, nothing ambiguous about the package. What remains is the one-key collapse, which is runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411's.
4. Unchanged, verified in the diff: a job a body's array holds answers that body by identity (first branch, untouched); a name no body declares answers the residual's owner or undefined (untouched); a two-body name with no surplus keeps fix(runtime, service-automation): a job's connector pull reads its mapping from the package that declares the job (ADR-0150 D3) #32294's refusal with a byte-identical message (the residual === undefined arm of jobNameRefusal); an artifact without packages[] answers appId (untouched). jobDeclaringPackages' exported signature is unchanged; jobNameRefusal is module-private.
5. Public surface: no schema, no export, no type member, no error code added. The refusal's candidates gains the residual's owner as a package holder when a body carries the artifact's id and does not itself declare the name. See nit N2 for the arm where no body carries it.

② Semver level

Matches. The diff moves @objectstack/runtime only and the changeset names it alone, at patch. Metadata-protocol: none is right: nothing an author can write is added, removed or refused at a schema, a build or a save door (the dev measured os build at exit 0 on the shape, and collectDuplicateEntryErrors reads one input stack, never the composition); what changes is which package a run is attributed to. none takes patch. Clause-②: no (narrowing) is on the PR body and the changeset body, line-initial in both, and it is the true arm: a run that completed is now refused. The changeset carries the BREAKING banner with the first-party count, exactly one ADR-0087 marker (not-required (no-migration-prescription), with a reason that holds: no stored shape changes), the FROM and TO, and the one-line fix (rename). It is the same shape #32294's changeset 32071-mapping-name-by-package.md shipped. Check Changeset and the lint lanes that run check:adr-0087-registration concluded success on this head.

③ Boundary flags

• open_questions: empty. Nothing to answer.
• Step 0 (the card's own gate): answered, the shape boots. The three legs the dev names hold in the cited code: jobs composes as 'concat' with no cross-input name check; jobKeyFor is called with packageId: appId for every job, so both jobs take one key; CronJobAdapter.schedule and IntervalJobAdapter.schedule cancel then set. So the narrowing arm stands and the claim's fallback (no, no arm) does not apply.
• Out-of-scope finding 1 (one key, the later job silently replaces the earlier): correctly routed, now card runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411. It is ADR-0150 D4's job-adapter row (the schedule key is the package coordinate) not yet delivered for a residual beside a body. That is an implementation gap, and this PR neither implements nor narrows it: the refusal here is about attribution, and the rename it prescribes clears the collapse too.
• Out-of-scope finding 2 (hand-written artifact without the flattened half): answered, accepted deviation. Verified: composeStacks strips the flattened half only when every input is attributed to a body (packagesCarryEveryInputCollection), and an input with no manifest fails that, so the compiler cannot emit a residual job without the flattened copies beside it. On a hand-written one, resolveArtifactCollections lets the top-level name claim the body's job, the count reads 1 against 1, and the residual's job is still attributed to the body, as before this PR. No count can see it: one top-level job of the name is exactly what a plain flattened copy looks like. artifact-collections.ts already rules a partly flattened artifact out of what the readers claim to resolve. Not a regression, recorded in the PR's acceptance notes, no finding.
• Deviations (resumed run, real CronJobAdapter in place of a push-array fake): the replacement is the right call, because the fake could not show which job of the pair survives. Runtime suite read on d8909747de rather than the head: superseded by the head's own Test Core 1/8 to 8/8 and Type Check lanes, all success.
• Does the green dogfood battery answer the narrowing arm? No, and it does not need to. The battery (451 files, exit 0, and Dogfood Regression Gate success on the head) shows no first-party flow regresses, which is what a first-party count of 0 predicts: no first-party job declares a pull, and the one first-party preserve composition (examples/app-multi-package) gives every input a manifest. It exercises no residual twin, so it is silent on the refusal itself. The arm is answered by pins 2 and 4 of the [#32355] describe, which ran inside Test Core on this head, and by the dev's reported ablation (pins 2 and 4 red with the branch disabled). The ablation is the dev's reading, not re-run here.

④ Design judgment

The narrowing makes the spec's own refusal real; it takes no declared capability away at the consumer. ADR-0150 D3 gives a bare name two outcomes, one holder or a refusal that lists the candidates, and says of every by-name read that it guesses nothing. Attributing a top-level job to a body because the body declares a job of the same name is a guess: the residual registers under manifest.id, so the residual's sync is another package's item (or no package's), and D3 has no step that hands it to a sibling. The capability that IS declared and not delivered is D4's: two jobs with two package coordinates both scheduled. That gap is #32411's to implement, and this PR does not narrow it in its place. It was not being delivered before either (one job dropped, the survivor possibly run as the wrong package), and the ADR's own D4 amendment note takes the same interim shape for flows: refuse the two-holder name, naming both, until the re-key lands.

Is "recognise a residual twin by count" sound? Tried to break it against the cited code:

• Body + residual, owner is another body (the card's shape). Top level [alpha copy, host], bodies declare 1: 2 over 1, refused, candidates alpha and the owner. Holds.
• Three jobs (one body, two manifest-less inputs each with the name; one input cannot repeat a name, collectDuplicateEntryErrors). 3 over 1: refused. Holds.
• Two bodies plus a residual. 3 over 2: refused through the residual arm, naming both bodies and the residual. Two bodies and no residual: 2 over 2, the count is silent and fix(runtime, service-automation): a job's connector pull reads its mapping from the package that declares the job (ADR-0150 D3) #32294's refusal answers as before. Holds.
• Residual's owner IS the one declaring body. One package, answered as that package (pin 3). With a second declaring body it is refused, the owner named once. Holds.
• Stripped artifact (every input has a manifest, the usual compiler output). No top level; collectBundleJobs returns the bodies' own objects, identity answers, the count is never consulted. Holds.
• Kept flattened half for another reason (a reconciled object) with no residual job. The count is equal for every job name; as before. Holds.
• Hand-written, partly flattened. A top-level name with FEWER jobs than the bodies declare never trips the count; with more (a copy written twice) it is refused, which is conservative and accurately worded. The one blind spot is the one under ③, unreachable from the compiler.
• Malformed input. Non-object jobs and non-string names are skipped on both sides of the count; duplicate package ids are refused upstream by resolveArtifactPackageEntries. Holds.
• Disabled. The artifact carries no package-level switch that the binder or the count reads, so there is no disabled-package case to diverge on. A job's own enabled: false is skipped by the binder but still counted: a disabled twin on either side still refuses the name. That is the right direction (the binder cannot tell which of the two top-level entries is the body's, disabled or not), and the prescribed fix, a rename, still clears it. See nit N3.
• By count, never by content. The jsdoc's reason holds in the cited code: the boot reads its bodies off a converted copy (app-plugin.ts, finding: AppPlugin hands the RAW artifact bundle to job scheduling and datasource registration, so a retired duration key (jobs[].timeout, turso config.timeout, memory config.persistence.autoSaveInterval) is silently dropped #23029, the conversion replays every body), so a genuine copy need not equal its body. The count's own premise is that a conversion does not rename a job; if one ever did, the top-level copy would read as a residual job of its own name, which is the pre-existing by-name limit, not something this diff adds.

Findings. No must-fix, no should-fix. Three nits; none touches correctness or the contract.

• N1 — nit (prose faces: the changeset and the PR body). The BREAKING paragraph and the FROM/TO are written from the residual's job. The body's own job of that name is refused too on a JSON-loaded artifact, including where it used to pull correctly as its body (judgment ①2). The title already says "attributed to neither"; one sentence in the BREAKING paragraph would say it where an upgrader reads. Fixable on the prose faces, or left.
• N2 — nit (jobNameRefusal, the arm where no body carries the artifact's id). It answers ambiguous-in-environment with ONE entry in candidates, while PackageScopedRefusalReason documents that reason as two or more package holders; the second holder is named in message only, because no PackageScopedHolder kind spells a residual that is no package. Every composition the pins build carries a body's id as the artifact's id, and the pins reach this arm only by passing an appId no body carries; the manifest strategy itself was not traced end to end, so read this as rare rather than impossible from the compiler. A holder kind is @objectstack/core surface, outside this card's file surface: accepted deviation, or a follow-up card if a consumer ever renders candidates alone.
• N3 — nit (test file). The disabled-twin behaviour above is neither pinned nor stated. A fix moves the head; leave it as an accepted deviation or fold a pin into runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411.

Implemented-by: claude/issue-32355-residual-job-package
Reviewed-by: session_01QSeKYm8sWjp2Pk76warN7w (contract-review subagent)

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Epic red-line re-read of #31527 for #32410 at head bd92690d · 2026-11-11T11:46Z. It follows the read 6793085339 at 33c3ec4f.

Verdict: PASS on the red lines. M1 is closed, and nothing is owed on this PR.

I read the delta 33c3ec4f..bd92690d and the net diff against origin/main (3 files, +257 / −6). Nothing was built or run. The contract review stays the lane's before ACCEPT.

• M1, closed.
  • The head carries feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405 (b96d492d) through merge 5467af43.
  • The merged binder keeps both: the declarerRefusal throw before any call, then jobRunId and trigger forwarded.
  • The source delta is feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405's hunk alone. The fourth pin's two expected pulls now carry trigger: 'manual' and no jobRunId, which is what CronJobAdapter.trigger() hands on this tree.
  • No other pin of this block reads a whole pull.
• The delta touches no red line.
  • The changeset sentence declares that the body's own job of the name is refused too on a JSON-loaded artifact. That is the count rule's stated consequence. It is fail-closed, and it is now inside the BREAKING paragraph.
  • The disabled-twin pin shows a disabled job on either side still refuses the name, and no pull is asked for. A disabled job does not hand its name to the other one, which is red line 2.
• Carried. S1 and N1 are card core + runtime: a residual-twin job refusal (ambiguous-in-environment) can carry one candidate; no PackageScopedHolder kind names a top-level job outside every package (ADR-0150 D3) #32412, a sub-issue of design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527. runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411 stays Blocked-by: #32410.
• Order. main is one commit past this head (48d6b477, driver-sql), with no file in common. A trial merge is clean.

At this reading the head's checks stand at 35 passed and 2 in progress, and the PR is still a draft.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Delta review rendered 2026-11-11T11:47Z by the same contract-review subagent, narrowing face, read-only. It follows record 6793121403 (PASS at 33c3ec4f). Inputs: the delta 33c3ec4f..bd92690d, the full net diff against main, the dev addendum 6794897842 on #32355, this PR's body, and the check-runs on the head.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: bd92690d4e38d3ee2df33005003f1f3edbd7210c
Local-runs: none
Scope: packages/runtime/src/app-artifact-handlers.ts, packages/runtime/src/app-artifact-handlers.job-pull.test.ts + the files named in record 6793121403 (read there, unchanged in what this diff claims about them), and packages/services/service-job/src/cron-job-adapter.ts (trigger() hands trigger: 'manual') for the changed pin — read in the cited code, none reviewed

Check-runs on this head, read at render time: 36 success, 18 skipped, 0 failed, 1 in progress. The one in progress is a second Check Changeset run started 11:46Z by the PR-body edit; the first Check Changeset run on this same head (10:28Z) concluded success, and the changeset file has not moved since. The second PR-body guards run concluded success while this record was being written.

① Derived judgments

Held, on the merged tree. The PR's own source hunks against main are line-for-line the ones reviewed at 33c3ec4f (the added and removed lines of app-artifact-handlers.ts against the merge base compare identical on both heads). What moved in that file between the heads is #32405's alone, arriving through the merge: the pull's run now takes the job context and forwards jobRunId and trigger.

• The refusal still comes before any call or write. In the merged run, if (declarerRefusal !== undefined) throw new PackageScopedNameRefusedError(declarerRefusal) sits before resolveJobPullOrganization and before service.pullConnectorSource, exactly as before; the forwarding lives inside the pullConnectorSource argument, which a refused run never reaches. Both are kept, neither displaced the other.
• No new accept-set or surface change from this PR. The forwarding is feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405's, already on main, and is not part of the net diff. Judgments ①1 to ①5 of the earlier record stand as written.

② Semver level

Unchanged and still matching: @objectstack/runtime at patch, Clause-②: no (narrowing) and Metadata-protocol: none on the PR body and the changeset, the BREAKING banner, one ADR-0087 marker, the rename fix. The delta adds one sentence to the BREAKING paragraph and changes nothing a gate reads.

③ Boundary flags

• M1 (the epic read's, 6793085339): delivered. The head merges main at 5467af4325, which carries feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405. Pin 4's expected pulls now carry trigger: 'manual', which is what CronJobAdapter.trigger() hands and the binder forwards, and no jobRunId, since that adapter writes no run row. The pin's assertion on callerPackageId is untouched. Test Core 1/8 to 8/8 concluded success on this head.
• N1: delivered. The changeset's BREAKING paragraph and the PR body's FROM/TO now say that on a JSON-loaded artifact the body's own job of the name is refused too, including where it used to pull correctly as its body, and why. That is the behaviour the tree has.
• N3: delivered. A fifth pin runs both orders (the body's job disabled, then the residual's): every job of the name answers the refusal, the binder schedules only the enabled one (out.pulls is ['sync']), its run fails 409 RESOURCE_CONFLICT, and no pull is asked. It also asserts which mapping the enabled job carries, so each arm is known to exercise the side it names.
• N2: left, with a carrier. The dev reports it routed to core + runtime: a residual-twin job refusal (ambiguous-in-environment) can carry one candidate; no PackageScopedHolder kind names a top-level job outside every package (ADR-0150 D3) #32412. Accepted deviation as graded before; nothing in the delta touches it.
• main moved by one commit after the merge and was not merged in. Fine: the queue tests the merged state, and this record covers this head only.

④ Design judgment

Unchanged. The narrowing still makes ADR-0150 D3's refusal real and takes no declared capability away at the consumer; the count logic in jobDeclaringPackages is byte-for-byte what was probed in the earlier record, and the new pin confirms the disabled-job probe by measurement rather than by reading. The merge adds one thing worth saying: a refused run forwards no jobRunId or trigger anywhere, because it never reaches the pull, so #32405's run record sees nothing from a refused twin. That is the right order (refuse first), and the job run itself records the failure, as pins 2 and 5 assert.

Findings on the delta. No must-fix, no should-fix. One nit.

• N4 — nit (PR body, prose face). The maintainer summary's two-minute check still says the -t 32355 run expects 4 cases; the describe now holds 5. Fixable in the PR body, which moves no head.

Implemented-by: claude/issue-32355-residual-job-package
Reviewed-by: session_01QSeKYm8sWjp2Pk76warN7w (contract-review subagent)

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

席位核对

ACCEPT · head bd92690d · 2026-11-11T11:48Z · card #32355 (ADR-0150 child)

• Shape: draft PR on main, Fixes #32355. 3 files, +257/−6: app-artifact-handlers.ts (jobDeclaringPackages, jobNameRefusal), the job-pull test (5 [#32355] pins), and the changeset.
• Declaration: Clause-②: no (narrowing), Metadata-protocol: none, patch on @objectstack/runtime, with a BREAKING banner and one ADR-0087 marker.
• What changes: a JSON-loaded artifact's residual top-level job that shares its name with one body's job is now refused 409 RESOURCE_CONFLICT ambiguous-in-environment, naming both. Before, it was attributed to that body. The one exception is when the residual's owner IS that body. First-party census: 0.
• Reviews of record:
  • CONTRACT_REVIEW_TIER, narrowing face: PASS 6793121403 at 33c3ec4f, then delta PASS 6794975177 on this head. N1 and N3 are delivered. N2 and the delta's nit are accepted.
  • Epic red-line read: 6793085339 at 33c3ec4f owed M1 (merge feat(sync-in): a pull's run record names the job run that drove it, and why that run started (ADR-0153 D7) #32405 and fix the controls pin). The re-read PASS 6794968868 on this head closes it.
• Dogfood battery (owed for a narrowing): one whole run under the lock on this head, VERDICT exit 0. Test Files 451 passed, 3 skipped. Tests 3775 passed, 42 skipped.
• Tests: runtime 581 files, 9757 passed, 19 skipped. Typecheck OK. Job-pull 43/43. Ablation (at 38ef518b): 2 red, restored byte-exact.
• Gates: 65 derived, 63 exit 0. The other 2 are NOT MEASURED locally (prerequisite) and green on CI. CI on this head: 37 success · 18 skipped · 0 failed.
• Carried:
  • runtime: two jobs of one name in one artifact share one job-service key, so the later one silently replaces the earlier and the replaced job never runs (no log line) #32411: two jobs of one name share one job-service key (Blocked-by: #32410).
  • core + runtime: a residual-twin job refusal (ambiguous-in-environment) can carry one candidate; no PackageScopedHolder kind names a top-level job outside every package (ADR-0150 D3) #32412: the one-candidate refusal and its holder kind, plus N2.
  • Both are sub-issues of design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527.
• Landing: NOT governed, 263 lines ≤ 3000, K = 1, merge-tree clean. Ready + auto-merge.

[objectstack-fleet]

domain:server#7 · os-justin · session_01QSeKYm8sWjp2Pk76warN7w

Landing · head bd92690d · 2026-11-11T11:50Z

Probe	Reading
check-runs on bd92690d (latest run per check)	55: 37 success · 18 skipped · 0 failed
review · governed · base	contract delta PASS 6794975177 and epic re-read PASS 6794968868 on this head; dogfood battery VERDICT exit 0 on this head; NOT governed, 263 lines ≤ 3000; K = 1; merge-tree clean

State: ready + auto-merge.