[objectstack-fleet]

Requested by Bill · project thread

epic:#31527#1 · os-bill · session_01Utp6CZu9RRx2o8sFUUpEPU

维护者速读

• 改了什么：两个不同命名空间的包现在可以各自声明同名 webhook，每个包的声明按（包，名）各自订阅、各自开关、各自投递；包的声明产生的投递 ref_id 改为 declared:PKG/NAME（环境自己的声明仍是 declared:NAME）；新增限定启用门 POST /security/_activation/webhook/:ns/:name；两个持有者时，裸读 /meta/webhook/NAME、/published 和裸启用门都答 409 并列出两者（启用门原来答 503）。第 2 轮：被禁用的包不算服务中的持有者（不派发、不可重投递，但账本归属仍按全部持有者算）；ref_id 上限 128 → 384，dedup_key 超过 191 时用 sha256 摘要，原来能投递的名字仍能投递；升级影响报告按（包，名）读。第 3 轮：不带包的旧投递（declared:NAME）重投递时按全部持有者计数，停用包也算，两个及以上即拒并逐个点名；changeset 与正文的几处说法按实测改正。第 4 轮（triage 复审 PASS 后的应修项，及合入 main）：只改文字，changeset 写明同命名空间冷启动封存的冲突两边都派发（S1），只列真实的公开导出（S2），全停用命名空间旁有他命名空间的启用持有者时答 409（S3），Clause-② 记七处；合入 main 后 metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791 的 CONTROL 只跑启动 pass 读的类型，另加一个 webhook CONTROL（纯测试）。第 5 轮（delta 复审 PASS 后的 S6 与一条 nit）：只改文字，Clause-② 记八处；Dispatch 一条写明「两边都不订阅」是 webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 以来 main 的答案，18.3.0 派发先注册者。
• 为什么改：ADR-0150 child B 的 webhook 部分（objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 三个 PR 中的第 2 个）。第 0 步实测：只翻三个集合而不改读取方，另一命名空间装进同名 webhook 后，两个持有者都会悄悄停发。所以先把派发器、开关账本、启用门、重投递守卫、名字守卫都改为按（包，名）读，再翻集合。
• 风险与回滚：收窄八处，已声明，前六处工作区内受影响的调用方为 0（第三处随合入 main 的 metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351 而来：两个包经 DatabaseLoader 保存的同名 webhook，不点名包读历史、比较、回滚改为 409 列出两者；第四处随合入 main 的 fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 而来：只有停用包持有的 webhook 名，MetadataFacade.get / getEntry 与 SchemaRegistry.resolveItem 由停用包的声明改为 undefined，exists 由 true 改为 false）：两个持有者的裸 /meta/webhook/NAME（及其 /published）由先注册者改为 409；按 ref_id = 'declared:NAME' 选投递行的消费方，升级后的新行要改为匹配 declared:PKG/NAME。ref_id 加宽在已有的 PostgreSQL/MySQL 库上要 os migrate apply（safe 的 widen_varchar），执行前，包 id 加名字超过 118 字符的单持有者 webhook 会在插入时被拒（第五处，裁定 Q2 已接受）。第六处：一启一停两个持有者时，不带包的旧投递 declared:NAME 的重投递，由按启用者判（上次发布 18.3.0 的树 badf24dff，及 fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 之后的 main）改为 409 列出两者。第七处：MetadataManager.get 不点名包读一个存有一个包的行和一条 package-less 行的 webhook 名，由先存的那行改为包的那行，两种顺序一样。第八处：两个都启用的持有者时，declared:NAME 的重投递由按先注册者判（上次发布 18.3.0，当时没有一持有者规则）改为 409 列出两者。滚动升级期间，旧节点重投递新形状的行会 fail closed（拒绝，不会发错持有者）；跨升级同一 webhook 的投递之间不保证顺序。只有一个持有者且其包已启用时，除新投递的 ref_id、未迁移库上的第五处、启用门在持有者自己的行旁有 package-less 行时由 409 改为写入、以及第七处外，所有答案不变。回滚即 revert。
• 先看：packages/plugins/plugin-webhooks/src/declared-webhooks.ts（packageScopedRegistryOf 的 served / every、slotsOf、webhookSlotSwitch、DeclaredWebhookSource），packages/runtime/src/domains/catalog-activation.ts（resolveQualifiedWebhook），packages/plugins/plugin-webhooks/src/redeliver-guard.ts（judgeDeclared，第 3 轮）。
• 两分钟验证：pnpm --filter @objectstack/plugin-webhooks exec vitest run src/declared-webhooks.test.ts 与 pnpm --filter @objectstack/runtime exec vitest run src/domains/catalog-activation-door.test.ts，应全绿；"one declaration per (package, name) slot"（含 "a disabled co-holder"）和 "a declared webhook two packages declare" 两节逐条钉住。
• 需要你做的：无，席位落地；第 2 轮的四个开放问题已由裁定 R3 定，第 4 轮的开放问题见文末。

Part of #31699

Clause-②: yes (narrowing) — eight answers move for a caller that worked before. (1) The bare GET /meta/webhook/NAME of a name two packages hold (a disabled package holds none here, #32497), and its published read GET /meta/webhook/NAME/published (which asks the bare item read for the item's package), are refused 409 RESOURCE_CONFLICT (ambiguous-in-environment, naming both), where they served the first registered package's declaration; before this change that state existed only for a clash the cold boot sealed with a warning. (2) A declared webhook a package ships is subscribed, and its new deliveries are written, under ref_id = declared:PKG/NAME, where they carried declared:NAME; a consumer that selects deliveries by ref_id = 'declared:NAME' no longer matches the ones written after the upgrade. (3) The history, diff and rollback of a webhook name two packages saved through DatabaseLoader (MetadataManager.getHistory / diff / rollback), naming no package, are refused 409 RESOURCE_CONFLICT (ambiguous-in-environment, naming both), where they answered every version of the one row both saves wrote, and a rollback to the version of a package removed since is refused 409 RESOURCE_CONFLICT (not-held-by-qualifier, naming it), where it wrote that body into the remaining holder's row: #32351's rules reach webhook with PACKAGE_SLOTTED_STORE_TYPES. (4) For a webhook name only disabled packages hold, MetadataFacade.get / getEntry and SchemaRegistry.resolveItem (@objectstack/objectql) answer undefined where they answered the disabled package's declaration, and MetadataFacade.exists answers false where it answered true: #32497's rule for the package-scoped readers reaches webhook with PACKAGE_SCOPED_READ_TYPES, and the by-name door already answered 404. (5) On an existing PostgreSQL or MySQL database before os migrate apply, a one-holder webhook whose package id and name together pass 118 characters, so that its declared:PKG/NAME reference passes 128, has its new deliveries refused at insert (the event lost, logged once), where they were delivered as declared:NAME; once os migrate apply widens sys_http_delivery.ref_id to 384 they are delivered. (6) A redelivery of a declared:NAME delivery of a name one enabled and one disabled package hold is refused 409 DELIVERY_NOT_ELIGIBLE naming both, where it was judged as the enabled holder's declaration (the last release's dispatcher reader withheld the disabled holder, as main does again since #32497). (7) The by-name read naming no package through DatabaseLoader (MetadataManager.get / getDiagnosed) of a webhook name stored as one package's row and a package-less row answers the package's row in either save order, where it answered the row saved first: the store keeps a row per (package, name) (PACKAGE_SLOTTED_STORE_TYPES), and the boot pass, which registers no webhook row, does not decide it. (8) A redelivery of a declared:NAME delivery of a name two enabled packages hold is refused 409 DELIVERY_NOT_ELIGIBLE naming both, where it was judged as the first registered holder's declaration (the last release, badf24dff at 18.3.0, had no one-holder rule, so two packages could each declare a webhook name, and its dispatcher reader answered the first registered one). Widened beside them: the engine's package door, item seam and cold-boot seal admit a second package holder of a webhook name that declares another namespace, and the dispatcher, which subscribed neither holder of such a name, subscribes each one; a clash inside one namespace that install refuses but the cold boot sealed with a warning (two co-owners of one namespace, two packages of a shareable namespace, or a package with no namespace beside another holder), FROM neither holder dispatched TO both dispatched, each under its own (package, name), while the bare and namespace doors answer 409 naming both, so only a package disable or a ledger row written directly stops one; the bare GET /meta/webhook/NAME of a name one enabled and one disabled package hold, where the disabled one registered first, answers the enabled holder's declaration (200) where it answered 404; and the unscoped plural reads (MemoryLoader and MetadataManager loadMany / loadManyKeyed) of a webhook name two packages saved answer both, where they answered the one saved last.
Metadata-protocol: added (a second package's webhook declaration of a name another namespace holds is now accepted, where it was refused 422 NAMESPACE_CONFLICT; no key, value or requirement an author writes against is refused or tightened)
Skills-docs: none — content/docs/automation/webhooks.mdx §3.0 is updated in this PR (the ref_id shape and the namespace door beside the bare one; seat-approved addition, 04:03Z), and §4.3's dedup_key sentence (ruling R3, Q4); no published skill teaches a declared webhook's name scope, its ref_id or the activation door (grep -rn "declared:\|_activation/webhook\|sys_http_delivery\|ref_id" skills/: one hit, skills/objectui/guides/data-integration.md:79, a comment about published keys, unrelated).

Narrowing: yes, first-party callers 0 for (1) to (6) and (8) (measured); (7) below. (1) No first-party package pair holds one webhook name across two packages; the full dogfood battery, which boots the showcase, CRM and every example app, is green with the refusal on. (2) No in-tree consumer selects sys_http_delivery by a literal declared:NAME: the four dogfood suites that read a delivery's ref_id are moved to the new shape in this PR (upgrade-18x-harness, webhook-materialization, wall-declared-webhook-deployment-wide, bare-name-one-holder-flow-family), and the CLI's 18.x ownership ceremony keeps writing declared:NAME (seat ruling Q4), which the redelivery guard still reads. (3) No first-party caller reads MetadataManager history: the REST /meta/:type/:name/history, /rollback and /diff doors go through the protocol's own repository (rest-route-ledger.ts:277, as #32351 states), and a grep of non-test sources finds no caller of MetadataManager.getHistory / rollback / diff outside metadata-manager.ts. (4) MetadataFacade is never constructed in-tree, and the one non-test caller of SchemaRegistry.resolveItem outside the facade, the protocol's by-name read (protocol-meta-item-reads.ts:577), already answered 404 for that name (grep, as #32497's changeset states for the other types). (5) is an operator step, os migrate apply with the upgrade. (6) and (8) need a name two packages hold, which no first-party pair does, as in (1). (7): no non-test source names webhook to MetadataManager.get / getDiagnosed (grep), and the dispatcher, the doors, the guards and the report read the registry or metadataService.list('webhook'); the protocol's generic by-name read calls getDiagnosed at its step 2 for every type (protocol-meta-item-reads.ts:1056), and whether a bare GET /meta/webhook/NAME reaches it in this shape is not measured (round 4, open question 1).

This is the second of three PRs for #31699: email_template (#32214, merged), webhook here, then connector. Only webhook joins NAMESPACE_SCOPED_BARE_NAME_TYPES here (the flow joined it with #31696, merged).

Seat rulings this PR implements

Comment 6813532941:

• Q1 = A. A ledger row naming no package, for a name two packages hold, is no holder's own (ADR-0150 D4). Switched off, it keeps every holder with no row of its own off. Switched on, it turns none on. The reader says so once per name, naming both. This is the flow engine's rule from objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696.
• Q2. All three type sets flip, the metadata slotted store included.
• Q3. The file surface below.
• Q4. The CLI 18.x ceremony keeps writing declared:NAME, pinned.
• Q5. Branch claude/project-thread-3giljf, a new draft PR, Part of #31699.

Round 2, comment 6816940784 (after CR 6816920433 and red-line 6816929999):

• R2-A (red line 1). A disabled package is no holder for what serves or dispatches; a durable read counts every holder. The readers and their reading are listed under "Two slices" below.
• R2-B. origin/main merged (no rebase). fix(metadata)!: the boot priming pass hands an unbundled slotted type's row on stamped with its row's package, so a save never inserts a package-less row #32548's boot-pass pins iterate DEFAULT_METADATA_TYPE_REGISTRY ∩ PACKAGE_SLOTTED_STORE_TYPES; a webhook CONTROL pins that the boot pass registers and writes no webhook row. How a stored package-scoped webhook row loads at boot is measured and pinned for one and two holders. webhook is not added to the type registry.
• R2-C (red line 3). Every name whose declared:NAME fitted still delivers: ref_id's cap is widened, the dedup_key cap was measured to bind first, and a key past it is digested.
• R2-D. The upgrade impact report reads webhooks by (package, name); the remedies name the namespace address; row (1) names /published, pinned.

Round 3, comment 6820856607 (after CR 6820826396 and red-line 6820837378):

• R3-A (M1, blocking). A redelivery reference that names no package counts holdersOf(name), a disabled package's included; with two or more holders it is refused naming each. Commit 6b72041b.
• R3-B (text). M2: the changeset's disabled co-holder bullet and the reader table below say what the protocol's by-name read answers (409 naming both, the disabled one included; a lone disabled holder 404; metadata-protocol: the generic by-name item read counts a disabled package as a holder for every package-scoped type but action (ADR-0150 D3) #32694); after the merge of fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 that read judges the served set, and both say so (17cec0fd0). M3: the changeset's package-less row sentence says what boot does and names metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692. M5: the meta-qualified-item-read.test.ts docblock and Q3 below say main answers 200 with the first registered declaration. S3: the un-migrated database condition is a plain FROM → TO. Q4: webhooks.mdx §4.3. Commit 77becda1.
• R3-C (optional, done). M4's two pins (the every-holder-disabled branch of the listed path; the bulk-event digest) and S2's pin (the report's covered by (package, name)). Commits 6b72041b, 48b4cba4.
• R3-D (follow-up cards). metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 (Q1 ruled B: the boot hydration's artifact lookup by (package, name); blocks objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699's close-out, lands before PR 3), metadata-protocol: the generic by-name item read counts a disabled package as a holder for every package-scoped type but action (ADR-0150 D3) #32694 (the protocol's generic by-name read counts a disabled holder, every package-scoped type but action; nested under metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354), plugin-webhooks: a ledger row naming a package that no longer declares a webhook switches the remaining holder, and the 18.x ownership ceremony falls back to the first-listed holder (ADR-0150 D4/D8) #32695 (S1 and S4).

Round 4, comment 6842178655 (after triage#1's contract review 6841104065, PASS with should-fix):

• S1. A clash inside one namespace that the cold boot sealed dispatches both holders: accepted as built for 18.4.0 and declared (the Clause-② widening, the Dispatch bullet). Its pin and an exact-qualifier door go to the p2 follow-up card plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016.
• S2, S3, S4, nits 4 and 5 (text). The exports paragraph names only declaredWebhookRefId; an all-disabled namespace answers 409 not-held-by-qualifier beside another namespace's enabled holder; the Clause-② line names (5); the door bullet gains the one-holder 409 → written row; the disabled co-holder bullet takes the last release as its one baseline, and under it (6). Commit 40c798157.
• The main-caused red found before the push (metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791's CONTROL on the merged tree, the epic seat's ruling B): main merged and the test fixed in the same push; the webhook's moved stored read declared as (7); the 18.3.0 reading cites its tree (badf24dff). Commits a5c37e97c, 26a846fe7.
• Follow-up card plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016 (p2): the S1 pin and door, the S3 co-holder pin, the nit 4 pin, S5 (two platform-checklist items), nits 1 to 3, and round 4's open question 1.

Round 5, comment 6843291373 (triage#1's delta review on c0500c639, PASS with one should-fix and one nit; the epic seat ruled both into this PR, text only):

• S6. By the last release's baseline an eighth answer moves: on badf24dff (18.3.0, no one-holder rule) a declared:NAME redelivery under two enabled holders was judged as the first registered holder's, and it is now refused naming both. Declared as (8), the Redelivery bullet gains that FROM, and BREAKING lists eight callers, (6) and (8) sharing one fix. Commit 68145a92a.
• Nit. The Dispatch bullet says its neither subscribed FROMs are main's since webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677, and that 18.3.0 dispatched the first registered holder alone. Same commit.

Two slices (R2-A, corrected by R3)

Reader	Reads	Why
slotsOf slots, list() (the dispatcher)	served	a disabled package's webhooks are not dispatched (#25308's listing)
declaredWebhookNamed (the reader's bare resolver: the bare activation door, the name guard)	served	the bare name answers the enabled holder alone
declaredWebhookAt (the redelivery veto of a declared:PKG/NAME delivery)	served	a delivery of a disabled package is refused, naming the package
bindDeclaredWebhookNameGuard	served	the conflict names the served holders' addresses
the qualified door's slots, the bare door's entry	served	an all-disabled namespace answers 404
the redelivery veto of a declared:NAME delivery (judgeDeclared, the reader's holdersOf)	every holder	a delivery row is durable: two or more holders are refused naming each, whichever is disabled (R3-A)
webhookSlotSwitch (ledger row ownership), reportUnownedRows	every holder	a row naming no package under two holders stays no holder's own while one is disabled
the door's adoptPackageless (the reader's new holdersOf)	every holder	a write for the enabled holder never takes over that row
the boot backfill (backfillActivationLedgerAtBoot)	every holder	already read the raw registry; unchanged
not this PR's reader: the protocol's by-name item read, GET /meta/webhook/NAME, /published, MetadataFacade.get	served (#32497, merged in 281722eb4)	under one enabled and one disabled holder it answers the enabled holder's declaration, /published as for that holder alone; a lone disabled holder answers 404 (the facade undefined). Before the merge it counted every holder (409 naming both), #32694's premise for the webhook

After the merge of #32497, SchemaRegistry.packageScopedHoldersOf answers the served holders unless asked otherwise, so the plugin's every-holder reading asks for every holder (includeDisabledPackages: true, 91acdcc3f); on the merged tree before that commit, 8 pins were red ("[FROM delivered TO withheld]", "[FROM A's switch TO no holder's]" and "[FROM allowed TO refused]", each in both orders; CONTROL one holder disabled; every holder disabled).

What changes (FROM → TO)

Surface	FROM	TO	Clause-②	Pin
Install (installPackage, registerItem, sealBareNameHolders): a second package of another namespace declares a webhook name	422 NAMESPACE_CONFLICT	admitted	widening	objectql flow-family "[#31699 PR 2, FROM 422 TO admitted]"; dogfood "theta installs as a third slot"
The same for a co-owner of the holder's namespace, a package with no namespace, two packages of base / system / sys, a built-in name	422	422, same envelope and sentence	—	flow-family CONTROL (unchanged)
Dispatch (DeclaredWebhookSource.list, AutoEnqueuer), a name two packages hold	neither subscribed, one warning (main since #31677; 18.3.0 badf24dff, before the one-holder rule: the first registered holder alone)	each holder subscribed in its own slot, with its own URL, secret, headers and switch	widening	"[FROM neither TO both]"
The same, a clash inside one namespace the cold boot sealed (two co-owners, two packages of base / system / sys, a package with no namespace beside another holder)	neither subscribed	both, each in its own slot; the bare and namespace doors 409 naming both, so only a package disable or a ledger row written directly stops one	widening (S1, accepted as built)	none here (#33016)
Subscription id = delivery ref_id = partition key, a package's declaration	declared:NAME	declared:PKG/NAME	narrowing (2)	"one package holder: dispatched exactly once, as declared:PKG/NAME"
The same, the environment's own declaration	declared:NAME	declared:NAME	—	same describe
Bare GET /meta/webhook/NAME, two holders	first registered served	409 ambiguous-in-environment naming both	narrowing (1)	objectql e8 "[FROM first-registered TO 409]", and its one-holder CONTROL
GET /meta/webhook/NAME/published, two holders	first registered served	409 naming both (it asks the bare item read for the package)	narrowing (1)	runtime meta-qualified-item-read "bare … and … /published: 409 naming both", one-holder CONTROL
GET /meta/webhook/NAME?package=ID	getItem	the resolver (PACKAGE_SCOPED_READ_TYPES): that package's own declaration	—	objectql e8 "[FROM first-registered TO 409]" (reads B by package)
The switch (sys_metadata_activation, webhook)	the name's rows read by name alone	each slot's own (package_id, name) row first	—	"the ledger: each slot reads its own row"
A row naming no package (or a package that no longer declares the name), one holder	the holder's switch	the holder's switch (ADR-0150 D8)	—	"[D8] one holder…"
The same row, two holders	not reachable	off keeps both off, on turns none on, warned once naming both (Q1 = A); after a restart the boot hydration still grafts a stored row of that shape onto the first-registered holder's slot (#32692)	new state	"[Q1] two holders and a row naming no package…"
POST /security/_activation/webhook/:name, two holders	503 SERVICE_UNAVAILABLE (the reader's error carried no refusal)	409 RESOURCE_CONFLICT with every candidate, nothing written	narrowing (reachable only in the newly admitted state)	plugin "two holders: the bare by-name read throws the 409… carrying the refusal" (A3); dogfood bare door
The same door, one holder	as before	as before; its package-less row becomes the holder's own (adoptPackageless)	—	runtime "CONTROL — one holder: the bare address…"
The same door, one holder whose own row sits beside a row naming no package	409 RESOURCE_CONFLICT naming both rows, nothing written (the name-addressed store)	the holder's own row written, the package-less one left	widening (nit 4)	none here (#33016)
The webhook activation store	addressed by name (a write for B re-attributed A's row)	addressed by (package, name) (WEBHOOK_LEDGER_ADDRESSING)	—	runtime "webhook/:ns/:name switches exactly that namespace's holder" (A4)
New POST /security/_activation/webhook/:ns/:name	400 (shape)	the holder among :ns's packages; two co-owners 409 ambiguous-in-namespace; none of :ns holds it 409 not-held-by-qualifier; unknown namespace or name 404	new door	runtime describe, four pins; dogfood alpha/qa_shared_hook 200
Four segments for any other type	400	400	—	runtime "the namespace address is the webhook's alone"
Redelivery of declared:PKG/NAME	n/a	judged by exactly that slot	new shape	"a delivery naming a package is judged by exactly that slot"
Redelivery of declared:NAME, one enabled holder	judged	judged as before	—	"[Q4] a delivery naming no package…"; round-3 CONTROL one holder
Redelivery of declared:NAME, one holder, disabled	refused as no longer declared (main's listing withholds the disabled package)	refused, naming the package as disabled (same 409 DELIVERY_NOT_ELIGIBLE)	— (same refusal, the reason names the package)	round-3 CONTROL one holder, disabled
Redelivery of declared:NAME, one enabled and one disabled holder	judged as the enabled holder's (the 18.3.0 tree badf24dff, whose listing withheld the disabled holder; main since #32497 the same)	409 DELIVERY_NOT_ELIGIBLE naming each holder, sent to neither (R3-A)	narrowing (6)	"[FROM allowed TO refused]", both orders
The same, two enabled holders	judged as the first registered holder's (the 18.3.0 tree badf24dff, which had no one-holder rule; main since #31677: reachable only by a sealed clash, refused naming both)	409 DELIVERY_NOT_ELIGIBLE naming each, sent to neither	narrowing (8) (S6)	CONTROL both enabled, both orders
A malformed reference (declared:/NAME, declared:PKG/A/B)	n/a	addresses no slot, refused as no longer declared	—	same describe
Mixed-version node reading declared:PKG/NAME	n/a	no declaration named PKG/NAME exists, so it refuses (fail closed)	—	"[mixed version]…"
The name guard (sys_webhook write of a name two packages declare)	the ambiguity refusal, 409	the declared-name conflict, 409	— (same status, right reason)	"the name guard…"
A host with no registry, two packages listed for one name	refused	one slot each	widening	"with no registry to resolve against…"
The same, one holder listed twice, or the environment beside a package	refused	refused, never first-picked	—	CONTROL
A registry whose every holder of the name is disabled, a metadata service listing an item of it	(round 2: the listed item dispatched)	nothing dispatched; re-enabled, the holder's declaration	—	round-3 "every holder disabled: the item a metadata service lists of the name is not dispatched" (M4)
MetadataManager's in-memory webhook store	one item per name (the second package overwrote the first)	one per (package, name)	—	metadata slotted-store set
A name one enabled and one disabled package hold: dispatch, the reader's bare resolver (the bare door, the name guard), redelivery of the disabled one's declared:PKG/NAME delivery	the last release (the 18.3.0 tree badf24dff): the enabled holder alone dispatched and resolved, its listing withholding the disabled one; main between #31677 and #32497 dispatched neither, since #32497 the enabled one (round 1 here: the disabled one dispatched and redeliverable)	the enabled holder alone dispatched and resolved; the disabled one's redelivery refused naming the package; re-enabled, resumed	— (red line 1)	"[FROM delivered TO withheld]", both orders; CONTROL both enabled; CONTROL a lone disabled holder
The same name: the protocol's GET /meta/webhook/NAME, /published and MetadataFacade.get	the first registered holder's declaration when that holder is the enabled one, 404 when it is the disabled one; re-enabled, the first registered served (measured: this head with webhook out of the three type sets, as main has them, 4 red, the objectql and runtime pins in both orders). Round 3's head before the merge of #32497 (2200b8c9): 409 naming both, the disabled holder counted	the enabled holder's declaration, either order; /published answers as for that holder alone; re-enabled, 409 naming both	widening (the enabled holder answers where a disabled first-registered one withheld the name); re-enabled, narrowing (1)	objectql e8 "[FROM the first registered, or nothing when it is the disabled one, TO the enabled holder's]" and runtime meta-qualified-item-read "[FROM the first registered, or 404 when it is the disabled one, TO the enabled holder's]", both orders
A lone disabled holder: the protocol's GET /meta/webhook/NAME; MetadataFacade.get / getEntry / exists and SchemaRegistry.resolveItem	the protocol read 404; the library reads the disabled package's declaration, exists true (measured the same way; 2200b8c9 the same)	404; undefined, exists false	narrowing (4)	objectql e8 "[FROM the disabled body TO undefined, library]"
The same, a ledger row naming no package	(round 1: re-attributed to the enabled holder)	no holder's own: off keeps the enabled one off, on turns none on (Q1)	—	"[FROM A's switch TO no holder's]", both orders
The door's switch of the enabled holder beside a row naming no package, the other holder disabled	(round 1: the row adopted)	the holder's own row written beside it	—	runtime "[FROM adopted TO beside it]"; CONTROL every holder is one: adopted (D8)
A namespace whose packages are all disabled, nothing else serving the name	(round 1: served)	404, nothing written	—	runtime "B disabled and alone"
The same beside an enabled holder of another namespace	(round 1: served)	409 RESOURCE_CONFLICT not-held-by-qualifier naming that holder, nothing written (S3)	—	none here (#33016)
sys_http_delivery.ref_id cap	128	384 (declared: + 255 package id + / + 119 name)	widening	sql-driver "[FROM lost TO delivered]" at the old 128 boundary
The same on an existing PostgreSQL or MySQL database before os migrate apply, one holder whose package id and name pass 118 characters	delivered as declared:NAME	refused at insert as declared:PKG/NAME (the event lost, logged once); after the migration, delivered	narrowing (5) (accepted, ruling R3 Q2; release-note line in the changeset)	derived from the caps, not measured on those databases
A webhook dedup_key past 191	refused at insert, the event lost	sha256: digest of the same string; a key that fits unchanged	widening	sql-driver "[FROM lost TO delivered]"; 191/192 boundary unit; CONTROL short name; the bulk-event path, round 3 (M4)
Upgrade impact report, a webhook ledger row naming P while another package ships the name	no finding	orphan; P's uncovered names are the suspected re-enablements	—	plugin-security "[FROM no finding TO orphan]"; CONTROL one holder; round-3 covered by (package, name) (S2)
The same report, a sys_webhook row of a name two packages declare	one finding	one per withheld holder	—	plugin-security "[FROM one TO each]"
Remedies (redelivery veto, declared-name conflict, withheld-row warning, the report)	the bare _activation/webhook/NAME	_activation/webhook/NS/NAME when the slot names a package; the environment's own keeps the bare address	—	"the remedies name the namespace address"; CONTROL the environment's own
GET /meta/webhook/NAME?package=ID (and the qualified path), the environment's package-less item (registered, or a stored row hydrated, stamped none, '' or sys_metadata), two holders	not reachable (this branch before the merge of #32741, 7f68e294b: 409 ambiguous-in-closure naming both)	each holder's own declaration, the item declined (#32741's rule for a sealed type); each list serves its own	new state	objectql exact-qualifier "[FROM 409 TO declined]", three stamps; CONTROL one holder (as main since #32741), an item bound to alpha
?layers=true&package=ID, a package-less stored row, two holders	not reachable (round 3 before the merge of #32566: each holder's overlay; 7f68e294b: 409 naming both)	no overlay at either holder, each code layer the holder's own (#32741)	new state	"[FROM each holder's overlay, then 409, TO declined]"; CONTROL one holder (as main since #32741), a row bound to alpha
The same row at the plain exact read, two holders	not reachable	declined (ADR-0126 Regime C): each holder serves and lists its own	new state	CONTROL "…declined at each plain exact read"
DatabaseLoader's webhook rows (sys_metadata)	one row per name, package_id NULL; a second package's save wrote over the first's	one per (package, name), package_id filled	—	metadata history "[FROM one row, every version TO a row each, 409]"
sys_metadata_history.package_id of a webhook save	NULL	the package of the row written	—	"[FROM no package TO the package]" (one holder: the history by name answers as before)
MetadataManager.getHistory / diff / rollback of a webhook name two packages saved, naming no package	every version of the one row ([3, 2, 1]); a rollback written into it	409 RESOURCE_CONFLICT ambiguous-in-environment naming both, nothing written; naming a package, its own versions and row	narrowing (3)	"[FROM one row, every version TO a row each, 409]"; the 16 #32351 cases its loop runs for webhook
A rollback to a removed package's webhook version	its body written into the remaining holder's row	409 not-held-by-qualifier naming it, nothing written	narrowing (3)	"[FROM B's body written TO 409]"
migrateDatabaseLoaderRowPackages, a webhook loader row whose body names a package	not a candidate: left as it was	bound to that package; a package-less one left (package-less)	widening	migration "[#31699 PR 2, FROM left TO bound]"; the 4 cases its loop runs for webhook
MemoryLoader and MetadataManager unscoped plural reads (loadMany, loadManyKeyed) of a webhook name two packages saved	the one saved last (measured: webhook out of PACKAGE_SLOTTED_STORE_TYPES, 3 red: the set pin and both orders; CONTROL green)	both, in the order first saved; the by-name read unchanged (the one saved last)	widening	metadata metadata-manager-keyed-plural-read (#32687's per-type cases, which now name webhook), both orders; CONTROL one holder
MetadataManager.get / getDiagnosed naming no package, a webhook name stored as one package's row and a package-less row	the row saved first (measured: the merged tree with webhook out of the slotted set)	the package's row in either order; the boot pass registers neither	narrowing (7)	metadata database-loader.test.ts "CONTROL webhook, slotted but not a type the pass reads…", 2 orders × 3 hosts

File surface

Claim (seat Q3): packages/plugins/plugin-webhooks/src/declared-webhooks.ts, auto-enqueuer.ts, redeliver-guard.ts; packages/runtime/src/domains/catalog-activation.ts; the three sets (packages/core/src/package-scoped-resolution.ts, packages/objectql/src/package-scoped-read.ts, packages/metadata/src/package-slotted-store.ts) and packages/objectql/src/bare-name-one-holder.ts's doc; their tests; the dogfood files; the changeset.

Seat-approved additions:

• packages/runtime/src/dispatcher-plugin.ts (the four-segment mount) and packages/runtime/src/route-ledger.ts (its server-only row): Claim amendment 6813666631.
• content/docs/automation/webhooks.mdx §3.0, scoped to the two sentences this PR makes false (the ref_id shape, and the namespace door beside the bare one): approved by the seat at 04:03Z. §4.3's dedup_key sentence: ruling R3, Q4.
• Round 2, by the ruling (6816940784): packages/metadata/src/loaders/database-loader.test.ts (R2-B); packages/objectql/src/webhook-stored-row-boot-hydration.test.ts (new, R2-B's boot path); packages/services/service-messaging/src/objects/http-delivery.object.ts and packages/plugins/plugin-webhooks/vitest.config.ts (R2-C: the cap, and a source alias so the plugin's tests read the service's source rather than a stale dist; the alias registry in scripts/check-test-source-alias.mjs narrows to match, as its gate requires); packages/plugins/plugin-security/src/upgrade-impact-report.ts and its test (R2-D); packages/runtime/src/domains/meta-qualified-item-read.test.ts (R2-D, /published). Gate-forced: scripts/engine-double-contract.pinned.json records the new boot-hydration test's findOne double (--write).
• Round 3, by the seat's order of 14:41Z (the main merge's rules under two webhook holders): packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/metadata/src/metadata-history.test.ts, packages/metadata/src/migrations/bind-database-loader-row-packages.test.ts.
• Round 3, from the main merges 281722eb4 (origin/main 2f80f2897, with fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 and fix(metadata)!: the metadata service's own reads keep every locale of a package's email template and every package's item of a by-package type #32687) and 491e70bc5 (origin/main 1ec547fc6, with feat(core, objectql, metadata, metadata-protocol, plugin-security): a permission-set name is held once per namespace, judged by one predicate (ADR-0150 child B) #32742): packages/metadata/src/metadata-manager-keyed-plural-read.test.ts, whose type list fix(metadata)!: the metadata service's own reads keep every locale of a package's email template and every package's item of a by-package type #32687 pins against the live slotted set, now names webhook (05499a374). The plugin fix (91acdcc3f) and the new pins are in files already listed.
• Round 3, from the main merge 9c5f3355 (objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696, the flow's narrowing): six test files whose "not narrowed" example was the webhook now name the connector (2200b8c9): core package-scoped-resolution.test.ts, metadata metadata-manager-action-slots.test.ts and metadata-manager-match-endpoint.test.ts, objectql package-scoped-e8-readers.test.ts, package-scoped-resolver.test.ts and registry-bare-name-one-holder-flow-family.test.ts.

Tests

• plugin-webhooks declared-webhooks.test.ts, new describe "one declaration per (package, name) slot (ADR-0150 D3/D4/D5, objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699)", 12 pins. auto-enqueuer-disabled-report.test.ts: the CONTROL expects the my_app slot's ref.
• runtime catalog-activation-door.test.ts, new describe "a declared webhook two packages declare (ADR-0150, objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699)", 7 pins. meta-write-org-scope.test.ts: its unmapped type is now queue, because webhook now has a package-scoped resolver.
• objectql: e8 readers (WIRED_SINCE gains webhook, plus a webhook /meta describe), ai-family (SWITCHED gains webhook), flow-family (the switch pin, "[objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 2, FROM 422 TO admitted]", and the CONTROL now the connector alone).
• dogfood bare-name-one-holder-flow-family.dogfood.test.ts: the cold-boot warning names only the connector; a nested describe boots two holders of qa_shared_hook and pins: each slot is off as shipped; the bare door answers 409; alpha/qa_shared_hook answers 200, and alpha alone is dispatched, with ref_id declared:com.qa.bare.alpha/qa_shared_hook, to https://hooks.example/alpha; theta installs as a third slot. upgrade-18x-harness, webhook-materialization and wall-declared-webhook-deployment-wide read the new ref_id (the harness's ceremony re-source at line 242 keeps declared:NAME, Q4).

Round 2:

• plugin-webhooks declared-webhooks.test.ts, nested describe "a disabled co-holder (objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 round 2)", every two-holder pin run in both registration orders: "[FROM delivered TO withheld]" (dispatch, the bare resolver, the redelivery veto naming the disabled package, holdersOf, and re-enabling resumes delivery), "[FROM A's switch TO no holder's]", the name guard judging the served set, CONTROL both enabled, CONTROL a lone disabled holder; beside it, the remedies pin and its CONTROL (the environment's own declaration keeps the bare address).
• runtime catalog-activation-door.test.ts: "[FROM adopted TO beside it]" (bare and namespace address), CONTROL every holder is one (adopted, D8), "B disabled and alone" (404, nothing written). meta-qualified-item-read.test.ts: the bare read and /published of a two-holder name answer 409 naming both, the namespace address reads one; CONTROL one holder (200; /published 404, nothing published).
• metadata database-loader.test.ts: BOOT_PASS_READS = UNBUNDLED ∩ DEFAULT_METADATA_TYPE_REGISTRY drives fix(metadata)!: the boot priming pass hands an unbundled slotted type's row on stamped with its row's package, so a save never inserts a package-less row #32548's boot-pass cases; "the types are taken from the tree" pins that the intersection is every slotted type but webhook; CONTROL webhook: the boot pass registers none of its rows and writes nothing.
• objectql webhook-stored-row-boot-hydration.test.ts (new): a real SchemaRegistry and ObjectStackProtocolImplementation.loadMetaFromDb. CONTROL one holder: a row naming it, or naming no package (D8), is its slot, and no environment holder appears. Two holders, both orders: a row naming one holder is that holder's slot, and the other keeps its shipped declaration.
• plugin-webhooks webhook-delivery-real-sql-driver.test.ts, describe at the old 128 boundary, one holder (declared:NAME exactly 128): "[FROM lost TO delivered]" (ref_id stored whole as declared:PKG/NAME, the dedup key a sha256: digest), CONTROL a short name keeps the plain key, and the 191 / 192 boundary unit.
• plugin-security upgrade-impact-report.test.ts: "[FROM one TO each]", "[FROM no finding TO orphan]", CONTROL one holder.

Round 3:

• plugin-webhooks declared-webhooks.test.ts, in the disabled co-holder describe: "[FROM allowed TO refused]" (A enabled, B disabled, a declared:NAME delivery refused naming both), both orders; CONTROL both enabled (refused naming both), both orders; CONTROL one holder (allowed; disabled, refused naming it). M4: "every holder disabled: the item a metadata service lists of the name is not dispatched" (re-enabled, dispatched).
• plugin-webhooks auto-enqueuer.test.ts, M4: "a dedup key past 191 is the digest on the bulk path too; one that fits is unchanged".
• plugin-security upgrade-impact-report.test.ts, S2: another package's switch of a name covers none of the orphan's package's names, and a row naming no package does (D8).

Round 3, from the main merge a0131ec1d (seat order, 14:41Z: probe each rule the merge brought that is keyed by the type sets this PR adds webhook to, under two webhook holders; pin what moves, record what does not):

• objectql package-scoped-exact-qualifier.test.ts, new describe "[objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 2] a package-less webhook of a name two packages hold is no holder's own, plain and layered (fix(metadata-protocol, cli)!: a package-less item of a name two packages hold is refused at both exact addresses for every narrowed type, and the layered read judges its exact address (ADR-0150 D4) #32566)", 9 pins: the premise; "[FROM each holder's overlay TO 409]" (the layered read of a package-less stored row); CONTROL one holder (the row is the overlay over the holder's code layer); CONTROL a row bound to alpha; the plain exact read of the environment's item refused naming both, three stamps, each list serving its own; CONTROL one holder, and an item bound to alpha; CONTROL the stored package-less row declined at the plain read.
• metadata metadata-history.test.ts, new describe "[objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 2] a declared webhook's history is per package (metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351)", 4 pins: the premise; "[FROM no package TO the package]"; "[FROM one row, every version TO a row each, 409]"; "[FROM B's body written TO 409]". The describe names the webhook, so taking it out of the set turns these red rather than dropping the 16 cases metadata: history and rollback for a slotted type are keyed by (type, name), so rolling back one package's version can overwrite the other package's row (ADR-0150 D4) #32351's loop derives for it.
• metadata bind-database-loader-row-packages.test.ts: "[objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 2, FROM left TO bound] a webhook loader row whose body names a package is bound to it; a package-less one is left".

Round 3, from the main merge 281722eb4 (#32497: a by-name door judges a name's served holders; #32687: the unscoped plural reads answer each package's item):

• plugin-webhooks declared-webhooks.ts (91acdcc3f): the every-holder reading asks the registry for every holder (includeDisabledPackages: true), since its holder read now answers the served ones. On the merged tree before that commit, 8 pins were red: "[FROM delivered TO withheld]", "[FROM A's switch TO no holder's]" and "[FROM allowed TO refused]", each in both orders; CONTROL one holder disabled; every holder disabled.
• objectql e8 readers, in the webhook describe: "[FROM the first registered, or nothing when it is the disabled one, TO the enabled holder's]", both orders (the protocol read and MetadataFacade.get answer the enabled holder's; re-enabled, 409 naming both); "[FROM the disabled body TO undefined, library]" (a lone disabled holder: the protocol read 404 as before; MetadataFacade.get / getEntry and SchemaRegistry.resolveItem undefined, exists false).
• runtime meta-qualified-item-read.test.ts: "[FROM the first registered, or 404 when it is the disabled one, TO the enabled holder's]", both orders (the item read serves the enabled one, /published answers as for it alone; re-enabled, both 409).
• metadata metadata-manager-keyed-plural-read.test.ts: fix(metadata)!: the metadata service's own reads keep every locale of a package's email template and every package's item of a by-package type #32687's per-type cases run for webhook (two packages' saves answer both, in the order first saved, both orders; CONTROL one holder).

Round 3, from the main merge 2173fae50 (origin/main bfbcd81fb, with #32676: the boot priming pass primes every holder of a name of a type stored per (package, name)):

• metadata database-loader.test.ts, fix(metadata)!: the boot priming pass primes every holder of a name two packages hold, of a type stored per (package, name), so a bare read of that name is refused after the pass as without it #32676's describe: its boot-pass cases iterated the live slotted set, so 9 went red for webhook on the merge ref. The pass walks DEFAULT_METADATA_TYPE_REGISTRY, which does not list webhook, so it primes none of its rows, on main as here; every read after it answers as without it, nothing dropped and nothing picked by order. The cases now run for BOOT_PASS_READS, and a webhook CONTROL pins those reads on four hosts (7f68e294b).

Round 4, from the main merge a5c37e97c (origin/main 04c35f095, with #32791 as PR #32802, 25ee50765: a stored package-less row the boot pass files under the host's package is one holder of an action name):

• metadata database-loader.test.ts, metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791's describe: its CONTROL "every by-package type" iterated the live slotted set and asked for the row the pass registered, so for webhook 3 cells went red on the merged tree (the package-less row saved last, on each host: com.alpha.app where it expected the package-less row). The pass registers no webhook row, so the read is the loader's own. The CONTROL now iterates BOOT_PASS_READS, as metadata: the boot priming pass primes one holder per name for unbundled slotted types, so a bare read of a two-holder name answers the last row saved instead of 409 (epic red line 2) #32521's and metadata: the boot priming pass hands a column-bound slotted row to register unstamped, so with two holders of a name the DatabaseLoader save inserts a package-less row (unbundled slotted types) #32458's describes do, and a webhook CONTROL pins the loader's answer: the package's row in either order on every host, the pass registering neither. FROM, with webhook out of the slotted set on the merged tree: the row saved first. Declared as (7).
• objectql package-scoped-exact-qualifier.test.ts and webhook-stored-row-boot-hydration.test.ts (the merge also brought fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741, a888c5c9e: a package-less row at a holder's exact address is declined for a sealed type): 7 webhook pins went red. Two holders: each holder's own declaration, where they answered 409. One holder: the environment's item, the layered overlay and the boot-hydrated package-less row are declined; with webhook out of the three sets (dists rebuilt) the same, so they are fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741's own, and no Clause-② entry is added. Re-pinned, each naming its FROM (c0500c639).

Round 3's scratch probes, two holders: #32566's layered read moved (since #32741, declined, above); #32351's DatabaseLoader history moved; the row-binding migration did not move between the heads.

Red on main, then green (round 1).

• plugin-webhooks: 9 of the 12 new pins are red on main. The three green on main are the mixed-version pin, the D8 one-holder pin and the listed-twice CONTROL, each of which pins an answer main already gives.
• runtime: 4 of the 7 are red on main, the four that use the namespace address (main answers 400 to four segments). The bare-address 409 pin passes on main, because its fake reader carries refusal; the 503 → 409 move is pinned in plugin-webhooks (the error's refusal, A3) and in the dogfood door, which boots the real reader.

Ablations, each through scripts/ablation-replace.mjs (mutation landed, restored to the HEAD blob with an empty git diff HEAD):

• A1, the ref id without the package: 2 red (one holder dispatched as declared:PKG/NAME; FROM neither TO both).

• A2, a slot's own row ignored (own = undefined in webhookSlotSwitch): 8 red (the three existing ledger pins and the existing redelivery refusal of a webhook switched off through the ledger; the new ledger slot pin, Q1, D8, and the slot-exact redelivery).

• A3, refusal dropped from DeclaredWebhookAmbiguousError: 1 red (the bare read's 409 carrying the refusal).

• A4, the door's webhook store back to name addressing: 2 red (the namespace door's own row; Q1's row beside the package-less one).

• A5, the served slice read as every holder (served = every): 6 red ("[FROM delivered TO withheld]", "[FROM A's switch TO no holder's]" and the served-set name guard, each in both orders).

• A6, ledger ownership read from the served slots: 2 red ("[FROM A's switch TO no holder's]", both orders).

• A7, the door's adoptPackageless counting the served holders: 1 red ("[FROM adopted TO beside it]").

• A8, ref_id back to 128: 1 red ("[FROM lost TO delivered]").

• A9, no dedup digest: 2 red ("[FROM lost TO delivered]"; the 191 / 192 boundary).

• A10, the report's ledger rows judged by the bare shipper: 1 red ("[FROM no finding TO orphan]").

• A11, the report's shippers without the listed webhooks: 1 red ("[FROM one TO each]").
  Round 3, on 2200b8c9 (the main merge a0131ec1d touches none of the files below):

• R3-1 (M1), the refusal of a declared:NAME delivery when more than one package holds the name, switched off: 2 red ("[FROM allowed TO refused]", both orders); 290 of 292 green.

• R3-2, the lone holder's refusal not naming the package (the owner taken from the one holder dropped): 1 red (CONTROL one holder, disabled, refused naming it).

• R3-3 (M4), the every-holder-disabled branch for an item a metadata service lists: 1 red ("every holder disabled: the item a metadata service lists of the name is not dispatched").

• R3-4 (M4), the bulk path without the digest: 1 red ("a dedup key past 191 is the digest on the bulk path too; one that fits is unchanged").

• R3-5 (S2), covered judged by name alone: 1 red ("[FROM covered TO a candidate]"). R3-6, the package-less row's coverage dropped: 1 red (the same pin, its D8 half).

Round 3, after the main merges (each restored to the HEAD blob, whole-tree git status --porcelain clean):

• R3-7, the every-holder reading without includeDisabledPackages (the merged tree before 91acdcc3f): 8 red, listed above.
• R3-8, webhook out of all three type sets, as main has them (the core, metadata and objectql dists rebuilt, and each set read back from its dist without webhook): 5 red in objectql e8 and runtime meta-qualified-item-read (the disabled co-holder pins in both orders, and the lone-disabled library pin). The FROM column of those rows is this reading.
• R3-9, webhook out of PACKAGE_SLOTTED_STORE_TYPES: 3 red in metadata-manager-keyed-plural-read (the set pin, and both orders of the two-package case); its CONTROL green.

Round 4, on 26a846fe7:

• R4-1, webhook out of PACKAGE_SLOTTED_STORE_TYPES: 3 red in database-loader.test.ts, the new webhook CONTROL among them; 271 green.
• R4-2, webhook out of PACKAGE_SCOPED_READ_TYPES: in the exact-qualifier webhook describe only the premise goes red (1 of 9). The declines come from fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741's sealed-type rule, not from the read set; these pins hold that the rule, under two holders, picks neither.
• R4-3, webhook out of all three sets (dists rebuilt): the three one-holder CONTROLs answer as at the head, the FROM of the one-holder rows above.

Two round-2 pins pin a path this PR does not change, so they have no ablation: the R2-B boot-hydration pins (loadMetaFromDb binds the rows alike with main's three sets, measured), and the /published 409 (with main's sets the same registry answers 200, the first registered package's, per the round-2 review, M5).

Gates and verification

Round 5, on 68145a92a (changeset text only; no source or test change): check-changeset-no-major, check:empty-changeset, check-adr-0087-registration, check:changeset-gate-self-tests and check:nul-bytes, exit 0. A trial merge with origin/main 994c7d673 (it brings #32999, which touches database-loader.test.ts) is clean; metadata on it 2169 of 2170, the one red the known TS7016 of a declaration-less local spec dist.

Round 4, on c0500c639 (40c798157 text; the main merge a5c37e97c, origin/main 04c35f095, --remerge-diff empty; 26a846fe7 and c0500c639 tests and changeset text):

• Build: the runtime closure, 38 of 38 tasks, with declarations.
• Gates the changed files feed, each exit recorded before any pipe: check-adr-0087-registration, check-changeset-no-major, check:changeset-fixed, check:empty-changeset, check:changeset-gate-self-tests, check:nul-bytes, check:test-source-alias, check:engine-double-contract (its pinned file auto-merged): exit 0. ESLint on the three changed test files, typecheck of metadata and objectql: exit 0.
• Suites: metadata 2165/2165; plugin-webhooks 292/292; objectql, the six files this PR touches, 620/620; runtime, the three files this PR touches, 413/413.
• Main after the merge: a trial merge with origin/main d4b14a850 (six commits after 04c35f095, three of them touching this PR's files) is clean, and the overlapping suites pass on it: objectql's six files 662/662, core package-scoped-resolution 32/32, runtime's three files 413/413, plugin-webhooks 292/292. So, per the seat's rule, no further merge.
• Not re-run (seat rule of 2026-11-12T21:58Z): the other 120 derived gates and the dogfood battery; CI and the merge queue run them.

Earlier heads, in short: c080016c7 ran all 130 derived gates and the nine package suites (webhook dogfood 61/61); d4f90f14d and 7f68e294b re-ran the gates their files feed and the touched suites, exit 0. The full dogfood battery last ran on d9cea3dc7 (454 files passed).

Acceptance notes

• Landing order (seat): after objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696 PR-3 (feat(objectql)!: two namespaces may each ship a flow of one name; addresses, actions and endpoints run their own package's (ADR-0150 child B) #32507, merged), objectql: narrow the phase-1 one-holder refusal from environment to namespace for picklist, mapping, dataset, api and function (ADR-0150 child B, picklist family) #31700 (feat(core, metadata, objectql, metadata-protocol)!: picklist, mapping, dataset, API and function names are held per namespace (ADR-0150 child B) #32513, merged) and objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183 (fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497, merged as 0763bf6ec, in the main merge 281722eb4); feat(core, objectql, metadata, metadata-protocol, plugin-security): a permission-set name is held once per namespace, judged by one predicate (ADR-0150 child B) #32742 (merged as 5defbfeb9) is in the main merge 491e70bc5, fix(metadata)!: the boot priming pass primes every holder of a name two packages hold, of a type stored per (package, name), so a bare read of that name is refused after the pass as without it #32676 (merged as 2ca09de55) in 2173fae50, and metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791 (PR fix(metadata): a stored package-less row the boot pass files under the host's package is one holder of an action name, not two, in the bare read's judgement #32802, 25ee50765), fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 (a888c5c9e) and fix(metadata-protocol)!: a pair address reads the package it names: its envelope is that package's, and an App pair two of whose modules hold the name is refused naming both (ADR-0150 D5) #32808 (c50d10c00) in a5c37e97c. catalog-activation.ts is also touched by feat(plugin-security, runtime, core)!: the permission-set grant, clone and activation doors take a package, and a grant is unique per package #32306 (merged); the main merge a0131ec1d keeps both changes in registerSecurityActivationRoutes: the permission store keeps PERMISSION_LEDGER_ADDRESSING, the webhook's store takes WEBHOOK_LEDGER_ADDRESSING, and every other type keeps the name-addressed store.
• Upgrade (ADR-0150 D10). Declared subscriptions live in memory only, so nothing stored is re-keyed. After the upgrade a one-holder declaration is subscribed once, as declared:PKG/NAME, and an event is delivered once (pinned in the plugin and in the dogfood upgrade harness, 2b). A delivery written before the upgrade keeps declared:NAME, and its redelivery reaches the one holder as before. A package-less ledger row is bound to the one holder by the existing boot backfill (activation-ledger-backfill.ts). On PostgreSQL or MySQL, os migrate apply widens ref_id (ruling R3, Q2).
• Mixed-version window. As the changeset's upgrade paragraph says: an old node fails closed on declared:PKG/NAME, no row is sent to another holder, and deliveries queued across the upgrade are not ordered against each other.
• The bare-name reason sentence in bare-name-one-holder.ts ("subscribes one declared webhook per name") is left as it is, as email_template's was in feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214; the type's narrowing paragraph beside it says what holds now.
• Out of scope, filed ui: the console reads and toggles a webhook by its bare name, so a name two packages hold answers 409 once #31699 PR 2 lands (ADR-0150 D3/D5) #32578 (Blocked-by this PR): the console (objectui) addresses a webhook by its bare name (step 0, "Other"; not re-measured here). With two holders the bare read and the bare activation door answer 409, so the console needs ?package= and the namespace address. Not in this PR.
• Follow-up cards, ruling R3-D: metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 (the boot hydration binds a stored webhook row of a two-holder name by registration or load order; blocks objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699's close-out, lands before PR 3), metadata-protocol: the generic by-name item read counts a disabled package as a holder for every package-scoped type but action (ADR-0150 D3) #32694 (the protocol's by-name read counts a disabled holder for every package-scoped type but action; for the webhook, fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 has since made that read judge the served set, pinned above, so its premise no longer holds for this type, and whether it closes is the seat's call), plugin-webhooks: a ledger row naming a package that no longer declares a webhook switches the remaining holder, and the 18.x ownership ceremony falls back to the first-listed holder (ADR-0150 D4/D8) #32695 (a departed co-holder's ledger row read as the remaining holder's switch; the 18.x ceremony's first-listed fallback).
• Connector duty (seat relay, comment 6816295828). connectorNameRefusal resolves with the caller and counts holders without it; now that fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 has landed, a disabled package's flow could dispatch to the enabled holder's connector instance. That state needs two connector holders, which this PR does not admit: connector stays outside NAMESPACE_SCOPED_BARE_NAME_TYPES here, and the flow-family CONTROL still pins its cross-namespace 422. The fix, in fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497's bundleAddressOf shape with both orders pinned, goes into the connector PR (3 of 3).
• Size: 42 files, +2046 / −288 against origin/main 04c35f095 at 68145a92a (2334 lines: 964 source, 1312 tests and dogfood, 58 docs and changeset), under 3000.

Round 4's open questions

1. GET /meta/webhook/NAME's step 2 (unmeasured). The shape: one holder, its package's stored row and a package-less stored row. The protocol's by-name read calls the metadata service's getDiagnosed (the DatabaseLoader read of (7)) at its step 2 for every type (protocol-meta-item-reads.ts:1056), only when steps 1 and 1b answer nothing; step 1 declines package-less stored rows (Regime C). Whether the bare read reaches step 2 here is not measured. Options: A, the probe on triage's ask; B, the p2 follow-up card plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016. The epic seat ruled B unless the delta asks.
2. metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692's residue, measured on this head. The package-less row is no longer grafted at boot (fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741). Still there, in both registration orders: a stored row naming a package that does not declare the name grafts onto the first-registered holder's slot, and of two rows each naming a holder only the last loaded applies. metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 keeps it.
3. (6)'s FROM. The contract review read it as existing only on main since fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497. The 18.3.0 tree (badf24dff, read, not booted) judged a declared:NAME redelivery by the listing, which withholds a disabled package, so the enabled holder's answer was released. Recommended: keep (6).

Round 2's open questions, as ruled (R3, 6820856607)

1. R2-B, a stored webhook row the boot hydration binds by registration order: ruled B, follow-up metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692. The changeset says what boot does today.
2. R2-C, an existing database: accepted. os migrate apply before references pass 128 characters; the changeset carries the FROM → TO and the upgrade line.
3. Row (1)'s FROM: no change; it is right as written. With the three type sets at main's, the bare read and /published over a registry holding both items answer 200 with the first registered package's declaration (M5); the docblock in meta-qualified-item-read.test.ts now says so.
4. The dedup_key docs sentence: approved and done (webhooks.mdx §4.3).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Utp6CZu9RRx2o8sFUUpEPU

[github-actions]

📓 Docs Drift Check

This PR changes 7 package(s): @objectstack/core, @objectstack/metadata, @objectstack/objectql, @objectstack/plugin-security, @objectstack/plugin-webhooks, @objectstack/runtime, @objectstack/service-messaging, touching 71 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/objectql/src/bare-name-one-holder.ts, packages/plugins/plugin-webhooks/vitest.config.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

39 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 994c7d673d3cebeccdf15993e190c2a0f03a2353.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/objectql/src/bare-name-one-holder.ts, packages/plugins/plugin-webhooks/vitest.config.ts) — pages documenting those are invisible to this run
• 13 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 74 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 994c7d673d3cebeccdf15993e190c2a0f03a2353 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ea2a8ed8d4e2742031e556e06d38f72a0123ae60 — the merge of head 68145a92a397a1d451250386ab4acfa009780aeb into base 994c7d673d3cebeccdf15993e190c2a0f03a2353, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ea2a8ed8d4e2742031e556e06d38f72a0123ae60 && git checkout ea2a8ed8d4e2742031e556e06d38f72a0123ae60
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 994c7d673d3cebeccdf15993e190c2a0f03a2353 68145a92a397a1d451250386ab4acfa009780aeb && git checkout -B drift-repro 994c7d673d3cebeccdf15993e190c2a0f03a2353 && git merge --no-ff 68145a92a397a1d451250386ab4acfa009780aeb

node scripts/docs-audit/affected-docs.mjs --json 994c7d673d3cebeccdf15993e190c2a0f03a2353

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 994c7d673d3cebeccdf15993e190c2a0f03a2353 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dfbaaebe7bf8535fba256e5d45b680bb4323b03d
Local-runs: probe — the PR moves dispatch, the activation ledger and redelivery, so the head was built in a separate worktree and the touched suites, ten ablations and three scratch probes were run (disabled holder, ref_id length, the CI red on merge with main); nothing pushed, worktree removed
Scope: .changeset/31699-webhook-names-per-namespace.md, content/docs/automation/webhooks.mdx, packages/core/src/package-scoped-resolution.ts, packages/metadata/src/package-slotted-store.ts, packages/objectql/src/bare-name-one-holder.ts, packages/objectql/src/package-scoped-e8-readers.test.ts, packages/objectql/src/package-scoped-read.ts, packages/objectql/src/registry-bare-name-one-holder-ai-family.test.ts, packages/objectql/src/registry-bare-name-one-holder-flow-family.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer-disabled-report.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.test.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.ts, packages/plugins/plugin-webhooks/src/redeliver-guard.ts, packages/qa/dogfood/test/bare-name-one-holder-flow-family.dogfood.test.ts, packages/qa/dogfood/test/upgrade-18x-harness.dogfood.test.ts, packages/qa/dogfood/test/wall-declared-webhook-deployment-wide.dogfood.test.ts, packages/qa/dogfood/test/webhook-materialization.dogfood.test.ts, packages/runtime/src/dispatcher-plugin.ts, packages/runtime/src/domains/catalog-activation-door.test.ts, packages/runtime/src/domains/catalog-activation.ts, packages/runtime/src/meta-write-org-scope.test.ts, packages/runtime/src/route-ledger.ts + packages/objectql/src/registry.ts, packages/objectql/src/activation-ledger-backfill.ts, packages/core/src/utils/metadata-activation-store.ts, packages/services/service-messaging/src/objects/http-delivery.object.ts, packages/services/service-messaging/src/sql-http-outbox.ts, packages/runtime/src/domains/meta.ts, packages/runtime/src/domains/packages.ts, packages/metadata-protocol/src/protocol-exact-qualifier.ts, packages/metadata/src/plugin.ts, packages/metadata/src/loaders/database-loader.test.ts (on origin/main), packages/plugins/plugin-security/src/upgrade-impact-report.ts, packages/cli/src/utils/organization-ownership-apply.ts, packages/spec/src/kernel/metadata-plugin.zod.ts

① Derived judgments

• Touched suites at head (built with OS_SKIP_DTS=1):

  • plugin-webhooks whole package 270/270;
  • runtime catalog-activation-door and meta-write-org-scope 98/98;
  • objectql e8 readers, ai-family, flow-family and ledger backfill 247/247;
  • core package-scoped-resolution 28/28;
  • metadata whole package 1402/1403. The one red is typescript-serializer-annotation.test.ts (TS7016), from the DTS-skipped build, not this PR;
  • cli Q4 ceremony 17/17;
  • dogfood flow-family, upgrade-18x, webhook-materialization and wall-declared-webhook 38/38.

• Ten ablations, each red:

  • R1, the subscription id without the package: 3 red.
  • R2, redelivery read by name: 1 red.
  • R3, webhookSlotSwitch ignoring the slot's own row: 8 red.
  • R4, an unowned row turning on holders under two slots: 1 red.
  • R5, the name guard reading ambiguity as "not taken": 1 red.
  • R6, the redelivery guard rethrowing the ambiguity: 1 red.
  • D1–D4, the door (back to name addressing, never adopting, adopting under two holders, picking the first co-owner): 2, 1, 1 and 1 red.

  So the dispatcher, the ledger, the redelivery guard, the name guard and the door are each pinned.

• Claims verified:

  • webhook is in all three sets (package-scoped-resolution.ts:149, package-scoped-read.ts:115, package-slotted-store.ts:106).
  • POST /security/_activation/webhook/:ns/:name is mounted (dispatcher-plugin.ts:2262) with its ledger row.
  • A package's declaration delivers under declared:PKG/NAME; the environment's own keeps declared:NAME.
  • Legacy declared:NAME rows are judged as before with one holder and refused naming both with two (pinned, ablation R6 red).
  • The CLI ceremony keeps declared:NAME (pin green).
  • Skills-docs: is true, and the changeset matches the body.

• CI at the head (06:50Z): 56 success, 12 skipped, 1 failure (Test Core (1/8)), 2 running.

• Trial merges:

  • origin/main 0f9b565: clean, but semantically red (MF2).
  • fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 (phk4r9): clean.
  • feat(objectql)!: two namespaces may each ship a flow of one name; addresses, actions and endpoints run their own package's (ADR-0150 child B) #32507 (wqgmuu): 8 conflict files.
  • feat(core, metadata, objectql, metadata-protocol)!: picklist, mapping, dataset, API and function names are held per namespace (ADR-0150 child B) #32513 (du44hj): 4 conflict files.
  • All of these conflicts are in the type sets, their doc and their tests.

② Semver level

• minor on five packages, with ! and a BREAKING banner, matches PR 1 (feat(objectql)!: email template names held per namespace, a send resolves its template from its package, and ?package= reads an email template exactly (ADR-0150 child B, webhook family 1/3) #32214).
• Clause-②: yes (narrowing) is on the body and the changeset, with the same two answers. Metadata-protocol: added is correct.
• The banner's "One holder: every answer is as before except the ref_id" is false until MF3 is settled.

③ Boundary flags

• The diff stays inside the claimed surface, plus the two seat-approved files and the doc.
• connectorNameRefusal is out of scope (PR 3). connector stays outside the narrowed set, with its 422 CONTROL pinned.
• One reader of the class lives outside the diff: plugin-security/src/upgrade-impact-report.ts (S1).
• The semantic conflict with main sits in another card's test (fix(metadata)!: the boot priming pass hands an unbundled slotted type's row on stamped with its row's package, so a save never inserts a package-less row #32548), see MF2.

④ Design judgment

Must-fix

1. MF1: a disabled package's declared webhook is delivered when another namespace's package holds the same name. Red line 1.
   • Where: packages/plugins/plugin-webhooks/src/declared-webhooks.ts:291-303 (slotsOf). It reads holders, items and resolution on the raw registry from packageScopedRegistryOf (:237-252). Those raw reads count a disabled package, while the listing the name came from withholds it.
   • What moves: A is enabled, and B of another namespace is disabled, and both declare NAME.
     • FROM: unreachable (install answered 422), and a lone disabled holder is not dispatched.
     • TO: B's declaration is subscribed and delivered to B's URL with B's secret, and a redelivery of declared:B/NAME is allowed.
     • Also TO: the bare read is refused, naming the disabled holder, and a legacy declared:NAME delivery of A is refused, where /meta treats a disabled package as no holder.
   • Measured, unit (a real SchemaRegistry, disablePackage(B)): one event gives two deliveries, one to /alpha and one to /beta. CONTROL: B alone and disabled gives no delivery.
   • Measured, booted (flow-family dogfood stack): a disabled kappa stops delivering its own-name webhook but keeps delivering the shared one.
   • Fix:
     • Give slotsOf and the resolver a registry slice that withholds disabled holders, as registry.ts:8949-8955 builds one.
     • Pin it in both registration orders, with CONTROLs: both enabled, and a lone disabled holder. Pin that re-enabling resumes delivery.
     • Settle adoptPackageless (catalog-activation.ts:523, :563) so it counts a disabled holder and never re-attributes a package-less "off" row to the enabled one.
     • Add the FROM → TO row.
2. MF2: CI is red, Test Core (1/8).
   • Where: packages/metadata/src/package-slotted-store.ts:106 meets packages/metadata/src/loaders/database-loader.test.ts:2071 on main (0f9b565, fix(metadata)!: the boot priming pass hands an unbundled slotted type's row on stamped with its row's package, so a save never inserts a package-less row #32548).
   • That describe iterates every unbundled member of PACKAGE_SLOTTED_STORE_TYPES and expects the boot priming pass to register each one.
   • webhook has no row in DEFAULT_METADATA_TYPE_REGISTRY, and the pass walks only that registry. So three cases fail (:2158, :2199, :2222).
   • Reproduced locally on the merge with main: 3 failed, 24 passed.
   • The seat rules the fix (ruling on objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699).
3. MF3: an undeclared one-holder answer moves, and an event is lost. Red line 3.
   • Where: declared:PKG/NAME (auto-enqueuer.ts:593, declared-webhooks.ts:153-155) is written as ref_id, capped at 128 (http-delivery.object.ts:126), and inside dedup_key, capped at 191 (:133).
   • What moves: with one holder, a long name that delivered before now fails the outbox insert, and the event is lost. It is logged once and reported nowhere else.
   • Measured, booted: a 101-character name gives Ref ID must be ≤ 128 characters (got 129) and the "event is LOST" line. On main its reference is 110 characters (computed, not run on main).

Should-fix

• S1. plugin-security/src/upgrade-impact-report.ts reads the webhook ledger and the declaring package by name.
  • shippingPackage (:443-446) and shipper (:536-541) take the first artifact of the name. So the report misses or under-names withheld webhooks under two holders.
  • Its remedies name the bare door (:746, :785), which answers 409 under two holders.
  • Read only, not run.
• S2. Two remedies point at a door that refuses: redeliver-guard.ts:233-235 and DeclaredWebhookNameConflictError (declared-webhooks.ts:593) name webhook/NAME for a slot that names a package. Name the namespace address there instead.
• S3. GET /meta/webhook/NAME/published (meta.ts:1556-1565) shares narrowing (1). Name it in the row and pin it.

Nits

• heldByRow (auto-enqueuer.ts:560-570) is by name. That is the safe direction; say so in the module doc.
• The body's "CI on the PR: not read yet" is stale.

The narrowing itself is right against the spec on main. The three must-fixes are what stops it.

Implemented-by: claude/project-thread-3giljf
Reviewed-by: session_01Utp6CYGYEUhpi29FpjLmxT

VERDICT: FAIL

[objectstack-fleet]

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Epic red-line read at dfbaaebe7b · 2026-11-12T06:52Z

Head-sha: dfbaaebe7bf8535fba256e5d45b680bb4323b03d

No PASS

• Red line 1 (resolution never loosened): broken.
  • With one holder enabled and a second holder of the same name disabled, the disabled package's declared webhook is subscribed, delivered to its own URL, and allowed on redelivery.
  • A lone disabled holder is not dispatched. So the answer depends on whether another namespace holds the name.
  • Measured in the unit suite with a real registry, and in the booted flow-family stack (declared-webhooks.ts:291-303).
  • Everywhere else it holds, each pin red under ablation:
    • a package-less row under two holders turns no holder on (R4);
    • a slot's row never switches another slot (R3);
    • the redelivery veto judges a named slot exactly (R2);
    • the namespace door never picks a co-owner (D4).
• Red line 2 (ambiguity reported, never guessed): holds in the diff.
  • The bare read, the bare door, the name guard and the redelivery veto each refuse a two-holder name naming both, each pinned.
  • A legacy declared:NAME delivery under two holders is refused and sent to neither.
  • Outside the diff, plugin-security/src/upgrade-impact-report.ts still takes the first package of a webhook name in a boot report. That is a guess in a report (should-fix S1).
• Red line 3 (independently releasable): broken, for two reasons.
  • CI is red on this head (Test Core (1/8)): three @objectstack/metadata tests that main added in 0f9b565 iterate the slotted store set that webhook joins.
  • A one-holder answer moves without a row or a pin. The longer declared:PKG/NAME overflows sys_http_delivery.ref_id (128) for a long webhook name, and the event is lost (measured at 129 characters).
  • The declared part is in order: both narrowings are in the body and changeset, each moved answer has a pin that goes red under ablation, and the one-holder CONTROLs are green.

[objectstack-fleet]

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 938f948b2c5e05938246e0bbdff89725ef02a243
Local-runs: probe — own worktree at the head; touched suites plugin-webhooks 284/284, runtime 156/156, objectql 250/250, metadata 1432/1433 (the one red is typescript-serializer-annotation.test.ts TS7016 from a DTS-skipped build, as in round 1), plugin-security report 42/42, service-messaging 888/888, core 29/29, dogfood 38/38; single-change ablations (each restored), scratch probes in both registration orders, a booted three-holder probe; the head merged with main c4b6160d21 built, touched suites and three gates re-run there
Scope: round-2 delta over FAIL records 6816920433 and 6816929999 and ruling 6816940784 (R2-A..D), plus a sweep of every webhook reader for served set versus every holder

① Derived judgments

R2-A (a disabled package is no holder for what serves; a durable read counts every holder): met, with two gaps.

• Booted with three holders, one disabled through the registry: only the enabled holder's event was delivered, and delivery resumed on re-enable. The served slots exclude the disabled package, and holdersOf lists all three.
• The activation door's bare address answers 409 naming the served holders only. The disabled package's namespace address answers 409 at the door and 404 on /meta/webhook/NS/NAME.
• Ablations that went red:
  • served holders unfiltered: 2 tests;
  • ledger ownership taken from the served set: 2;
  • holdersOf taken from the served set: 2;
  • the door's adoptPackageless, three variants: 1 each;
  • ledger addressing: 3.
• Gap 1 is the legacy redelivery case (M1). Gap 2 is the GET /meta bare read (M2).
• The branch at packages/plugins/plugin-webhooks/src/declared-webhooks.ts:371 has no pin (M4).

R2-B (stored webhook rows at boot): pins exist for the order-free cases only.

• The three boot-hydration pins pass with the three type sets reverted, so they pin existing behaviour, as the dev says.
• The residual in Q1 reproduces in both registration orders:
  • a stored row naming no package, or naming a non-holder, lands in the first-registered holder's slot;
  • of two rows each naming a holder, only the last loaded applies.
• The census warning metadata_sealed_overlay_unserved fires for these rows, while the dispatcher does serve the first kind. The changeset says the opposite (M3).

R2-C (delivery references): met at the per-record site, unpinned at the bulk site.

• Ablations that went red:
  • ref_id back to 128: 1;
  • the dedup_key boundary: 1 on each side;
  • digest off at the per-record site (auto-enqueuer.ts:1244): 1.
• Digest off at the bulk-event site (auto-enqueuer.ts:1401) leaves 284/284 green (M4).

R2-D (remedies name the namespace address) and the upgrade-impact report by (package, name): met.

• Ablations that went red: the name-guard remedy (2), the redelivery remedy (1), the report's ships (1), the report's shippers (1).
• The report's covered by (package, name) stays green under two ablations (S2).

CONTROL (one-holder answers unchanged): holds, except as declared.

• The one-holder pins are green: the metadata boot-pass read, the boot-hydration control and the dogfood control.
• The only one-holder answer that moves is the new ref_id shape, declared as row (2).
• One undeclared condition sits on an un-migrated PostgreSQL or MySQL database (Q2, S3).

Moved answers declared and pinned.

• Row (1), from 200 first-registered to 409 naming both: declared. Its pin goes red when the type-set flip is reverted, where the read answers 200 with the first-registered declaration. The FROM is correct as written.
• Row (2): declared and pinned.
• The disabled co-holder bullet is declared, but its GET /meta clause is false (M2).
• The legacy redelivery answer is neither declared nor pinned (M1).

Class sweep.

• Readers on the served set, pinned: dispatch, the door's bare address, the name guard, and redelivery of a package-named reference.
• Readers on every holder, pinned: ledger row ownership, the unowned-row report, the door's adoptPackageless, and the boot backfill.
• Two readers are on the wrong side:
  • redelivery of a reference naming no package reads the served set, and should read every holder;
  • the protocol's generic by-name read reads every holder, where the changeset says the served set.

② Semver level

• minor on seven packages, with the breaking marker and Clause-②: yes (narrowing), is unchanged from round 1. The ref_id widening is additive.
• check-adr-0087-registration passes on the merged tree, including main's new fix(adr-0087): refuse not-required (no-migration-prescription) on a declared Metadata-protocol: narrowed #32649 rule. The changeset carries Metadata-protocol: added, which that rule does not refuse.
• No level change is needed: M1 to M3 change text and one guard, not the level.

③ Boundary flags

• Schema change on a system object. sys_http_delivery.ref_id goes from 128 to 384, which needs os migrate apply on an existing PostgreSQL or MySQL database (Q2).
• Mixed versions. No double enqueue across versions was found. Record events are in-process (the in-memory realtime adapter is the only one in the tree), so one node enqueues each write. This is from reading, not booted.
• Not measured: the dev's claim that an old node redelivering a new-shape row fails closed.
• Class gap outside this PR. The protocol's generic by-name read (packages/metadata-protocol/src/protocol-meta-item-reads.ts) counts disabled holders for every package-scoped type except action. Measured the same for email_template. It needs its own card.
• Size: 33 files, +1566/−256 = 1822 changed lines.

④ Design judgment

Must-fix

• M1. Legacy redelivery picks a holder.
  • Where: packages/plugins/plugin-webhooks/src/redeliver-guard.ts:213-216. A reference that names no package is judged by declaredWebhookNamed, which reads the served set.
  • Measured in both orders:
    • two holders, one enabled and one disabled: a declared:NAME delivery is allowed;
    • both enabled: refused, naming both;
    • a lone disabled holder: refused.
  • The function's own doc says such a delivery "belongs to one of them, and nothing says which", and that is still true when one holder is disabled. A delivery row is a durable reference, so R2-A's "a durable read counts every holder" applies.
  • Fix: when the reference names no package, count holdersOf(name), and with two or more, refuse naming each. Pin both orders, with controls for one enabled holder (allowed), a lone disabled holder (refused) and two enabled holders (refused).
• M2. The changeset's GET /meta clause is false.
  • .changeset/31699-webhook-names-per-namespace.md:30 says the bare read GET /meta answers the enabled holder.
  • Measured in unit tests in both orders, and booted: GET /meta/webhook/NAME and /published answer 409 naming both holders, the disabled one included. A lone disabled holder answers 404.
  • The answer fails closed, so the code is safe; the text and R2-A's list are not met.
  • Fix: correct the sentence and the PR body's reader table, and take the class card from ③.
• M3. The changeset's package-less row sentence is false after a restart.
  • Line 23 says a package-less row over a name two packages hold "is no slot's and is not dispatched".
  • On the boot path, that row is grafted into the first-registered holder's slot and dispatched as that holder's.
  • The PR body's Q1 says this, but the changeset, which ships, says the reverse.
  • Fix: qualify the sentence to what boot does, and name the follow-up card (Q1).
• M4. Two R2 branches have no pin.
  • declared-webhooks.ts:371, the "every holder disabled, nothing served" branch. With it removed, all suites stay green, and a lone disabled holder's webhook that a metadata service lists is dispatched.
  • auto-enqueuer.ts:1401, the digest at the bulk-event site.
  • Fix: one test each.
• M5. A false "measured on main".
  • packages/runtime/src/domains/meta-qualified-item-read.test.ts:592-593 and the PR body's Q3 say main already answered 409 over a registry holding both items.
  • With the three sets reverted and dist rebuilt, the read answers 200 with the first-registered declaration, and the pin goes red.
  • The docblock contradicts Clause-② row (1) inside the same PR. Fix: correct the docblock and the body. A stale dist during the dev's measure is the likely cause.

Should-fix

• S1. A departed co-holder's ledger row is read as the remaining holder's switch.
  • In webhookSlotSwitch, if (slots.length <= 1) return unowned.every(Boolean) treats a row naming a non-holder package like a package-less row.
  • Measured: holder A shipped off, a row naming departed B with active: true, and A is on. The off direction follows from the same line.
  • A grep of non-test sources found no removal of activation rows on uninstall. Not booted.
  • Fix: adopt only the row naming no package, and report the rest.
• S2. Pin the upgrade-impact report's covered by (package, name) at packages/plugins/plugin-security/src/upgrade-impact-report.ts:604.
• S3. Reword "as it was before" in the changeset's delivery-references bullet (Q2).
• S4. The CLI ownership ceremony falls back to the first-listed holder (declared.get(name)) when a seeded row's definition has no _packageId (packages/cli/src/utils/organization-ownership-apply.ts). Under two holders that is a pick; refuse or report instead.

Nit

• The disabled filter in served.getPackageScopedItem is redundant: ablating it changes nothing.
• A remedy's <namespace> segment is unusable for a package with no namespace.

Implemented-by: claude/project-thread-3giljf
Reviewed-by: session_01Utp6CYGYEUhpi29FpjLmxT

VERDICT: FAIL

[objectstack-fleet]

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Epic red-line read at 938f948b2c · 2026-11-12T10:14Z

Head-sha: 938f948b2c5e05938246e0bbdff89725ef02a243

No PASS. Red lines 1 and 2 each have one breach at this head, and both come from the same defect (M1 of the contract review). Red line 2 also has one carried residual. Red line 3 holds with one condition.

Red line 1: resolution never loosened. Not clean.

• Holds.
  • The type-set flip moves bare answers only toward refusal: the bare read from 200 first-registered to 409, and the door from 503 to 409.
  • A disabled holder is not dispatched (booted).
  • A namespace address reads exactly one holder.
  • The door, guard and ledger pins all go red under ablation.
• Breach. A veto that holds for a lone holder is loosened by a co-holder. A declared:NAME delivery of a disabled package is refused while that package is the only holder, and allowed once another enabled package holds the same name, in both orders (M1).
• Unpinned: the "every holder disabled, nothing served" branch (M4).

Red line 2: ambiguity reported, never guessed. Not clean.

• Holds.
  • The bare read, the door and the name guard answer 409 naming the holders.
  • A legacy redelivery under two enabled holders is refused naming both.
  • A ledger row naming no package under two holders is no holder's.
  • The door never takes over the package-less row under two holders.
• Breach. The M1 case picks the enabled holder for a row that names none.
• Carried residual (Q1). After a restart, a residue stored webhook row is bound by registration order or by load order. The census reports the row, but it is served for one holder all the same. The state is newly reachable through install, and the changeset states the opposite (M3).
• Also: S1, a row naming a departed package is read as the remaining holder's switch.

Red line 3: every child independently releasable. Holds, with one condition.

• CI at the head: 72 check runs, 60 success, 12 skipped, 0 failed, none running.
• Main: K = 19, and the trial merge is clean.
• Merged tree:
  • build ok;
  • webhooks 285/285, runtime 156/156, objectql 250/250, security report 42/42, core 29/29, metadata 1477/1478 (the same DTS-skip red);
  • the gates check-adr-0087-registration, check-engine-double-contract and check-test-source-alias all exit 0.
• Chain branches: each conflicts, so whichever lands second merges main and resolves.
  • wqgmuu, 8 files;
  • du44hj, 5 files;
  • phk4r9, 1 file: packages/runtime/src/domains/meta-qualified-item-read.test.ts.
• Condition (Q2). On an existing PostgreSQL or MySQL database that has not run os migrate apply, a one-holder webhook whose package id plus name exceeds 118 characters moves:
  • it was delivered before as declared:NAME;
  • it is now refused at insert as declared:PKG/NAME until the migration runs.
  • This is derived from the caps, not measured on those databases.
• Unpinned: the bulk-site digest (M4).

[objectstack-fleet]

epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT

Epic ruling R3 on #31699 PR 2 · 2026-11-12T10:15Z

Records ruled on: contract review 6820826396 and red-line read 6820837378 at 938f948b2c.

Governing text: the epic's red lines 1 and 2; R2-A of 6816940784 (a durable read counts every holder); the maintainer's rule of 2026-11-12 09:41Z (「简单的问题是否可以后续单独立卡处理」): only correctness, red-line or security issues block a merge, and smaller items become follow-up cards.

R3-A. Blocking, the one code fix: M1.

• A redelivery reference that names no package counts holdersOf(name). With two or more holders, it is refused naming each.
• Pin both orders, with three CONTROLs: one enabled holder (allowed), a lone disabled holder (refused), two enabled holders (refused). Ablate once.

R3-B. Text corrections that ship in the same push (they are the shipped changeset, so they cannot wait for a later card). No re-review round for them:

• M2: correct the GET /meta clause and the reader table to what is measured (409 naming both holders, the disabled one included; a lone disabled holder answers 404).
• M3: qualify line 23 to what boot does, and name the Q1 card.
• M5: correct the docblock at meta-qualified-item-read.test.ts:592-593 and the body's Q3.
• S3: replace "as it was before" with the plain FROM → TO of the Q2 condition.
• Q4: the one-sentence webhooks.mdx:444 fix is approved.

R3-C. Optional in the same push, otherwise follow-up: M4's two pins (declared-webhooks.ts:371, auto-enqueuer.ts:1401) and S2. They are one test each, so add them if the push is happening anyway. They do not block.

R3-D. Follow-up cards, filed by the dev thread and nested under #31699:

1. Q1, ruled B. Boot hydration binds a residue stored webhook row by registration or load order. The fix keys the hydration's artifact lookup by (package, name). This card blocks objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699's close-out and lands before PR 3. It also covers the census text "No read serves them".
2. The protocol's generic by-name read (protocol-meta-item-reads.ts) counts disabled holders for every package-scoped type except action (③). Nest it under ADR-0150: the email template send judges the served holders (a disabled package holds no name at the send) #32670's family if it fits better there.
3. S1, a departed co-holder's ledger row read as the remaining holder's switch, together with S4, the CLI ownership ceremony's first-listed fallback.

Q2: accepted. os migrate apply before references over 128 characters, with the release-note line and the FROM → TO of R3-B.

Q3: no change to row (1)'s FROM. It is right as written (M5).

Next. Push R3-A and R3-B together. The seat reads the M1 delta itself, with no full review round, and lands after #32497 per the chain order.

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUJAvdCcvoqdsFGVz8

Contract-review delta request · triage#1 · 2026-11-13T03:32Z

Head-sha: c0500c639fb2ad8bb0dfc866b198337983a283bb

For triage#1, who rendered contract review 6841104065 (PASS with should-fix) on 7f68e294b. Epic ruling 6842178655 asks for the same reviewer's delta review before the epic seat's ACCEPT. The delta is 7f68e294b..c0500c639. It has no source change; the last source commit is 91acdcc3f.

Commits

• 40c798157: changeset text for S1, S2, S3, S4 and nits 4 and 5.
• a5c37e97c: merge of origin/main 04c35f095; --remerge-diff is empty. It was found before the push: a trial merge was red, and the epic seat ruled B.
• 26a846fe7: metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791's by-package CONTROL in database-loader.test.ts runs for the types the boot pass reads, plus a webhook CONTROL, declared as Clause-② (7).
• c0500c639: 7 webhook pins in objectql package-scoped-exact-qualifier.test.ts and webhook-stored-row-boot-hydration.test.ts re-pinned to main's fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 (a package-less row at a holder's exact address is declined for a sealed type). The changeset's exact/layered bullet and the boot-hydration sentence in the Dispatch bullet are corrected.

Where each item landed (the changeset .changeset/31699-webhook-names-per-namespace.md; the PR body r6 carries the same Clause-②: line)

• S1: the Clause-② widening sentence and the Dispatch bullet name the cold-boot-sealed clash inside one namespace: FROM neither dispatched TO both, the doors answering 409 naming both, stopped only by a package disable or a ledger row written directly.
• S2: the "Public surface" paragraph names declaredWebhookRefId(name, packageId?) as the one export that moves and calls the rest internal. No export is added.
• S3: in the disabled co-holder bullet, an all-disabled namespace answers 404 only when nothing else serves the name. Beside another namespace's enabled holder it answers 409 not-held-by-qualifier naming that holder.
• S4: the Clause-②: line names (5), PostgreSQL or MySQL before os migrate apply with a reference past 128 characters.
• Nit 4: the activation-door bullet adds the one-holder row, 409 to written.
• Nit 5: the disabled co-holder bullet takes the last release as its one baseline, read from the 18.3.0 tree badf24dff (read, not booted). Under it, a declared:NAME redelivery beside a disabled holder moves from allowed to refused, so the line names it as (6). That differs from 6841104065's reading that this FROM exists only on main since fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497; please check it against that tree.
• (7): MetadataManager.get naming no package, on a webhook name stored as one package's row plus a package-less row, now answers the package's row in either order. It used to answer the row saved first. The BREAKING banner covers seven callers.
• fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741, no Clause-② entry: measured on the merged tree with webhook out of all three type sets (dists rebuilt and read back), main gives the same three one-holder answers. Under two holders each holder answers its own declaration, and nothing is picked. That FROM (409) was never released.

Gates and tests on c0500c639

• Gates: check-adr-0087-registration, check-changeset-no-major (also run against the r6 body as a pull_request payload), the changeset self-tests, check:nul-bytes, check:test-source-alias, check:engine-double-contract, ESLint on the changed files, and metadata and objectql typecheck: all exit 0.
• Suites: metadata 2165/2165, plugin-webhooks 292/292, objectql's six touched files 620/620, runtime's three touched files 413/413.
• Ablations: R4-1 to R4-3 are in the body.
• Trial merge with origin/main d4b14a850: clean, and the overlapping suites are green.

Open questions: dev report 6842933276 on #31699. They are: GET /meta's step 2 (unmeasured; the seat ruled it goes to the p2 follow-up unless this delta asks for the probe), #32692's residue on this head, and (6)'s FROM.

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUJAvdCcvoqdsFGVz8

Duplicate: this comment was sent twice by mistake. The delta request is comment 6842991779 above; this one carries nothing to review.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head c0500c6 · 2026-11-13T03:37Z

Delta review of the should-fix S1–S4 from the PASS on 7f68e294, by the same reviewer, at CONTRACT_REVIEW_TIER (narrowing face).

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c0500c639fb2ad8bb0dfc866b198337983a283bb
Local-runs: none
Scope: packages/core/src/package-scoped-resolution.test.ts, packages/core/src/package-scoped-resolution.ts, packages/metadata/src/loaders/database-loader.test.ts, packages/metadata/src/metadata-history.test.ts, packages/metadata/src/metadata-manager-action-slots.test.ts, packages/metadata/src/metadata-manager-keyed-plural-read.test.ts, packages/metadata/src/metadata-manager-match-endpoint.test.ts, packages/metadata/src/migrations/bind-database-loader-row-packages.test.ts, packages/metadata/src/package-slotted-store.ts, packages/objectql/src/bare-name-one-holder.ts, packages/objectql/src/package-scoped-e8-readers.test.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/objectql/src/package-scoped-read.ts, packages/objectql/src/package-scoped-resolver.test.ts, packages/objectql/src/registry-bare-name-one-holder-ai-family.test.ts, packages/objectql/src/registry-bare-name-one-holder-flow-family.test.ts, packages/objectql/src/webhook-stored-row-boot-hydration.test.ts, packages/plugins/plugin-security/src/upgrade-impact-report.test.ts, packages/plugins/plugin-security/src/upgrade-impact-report.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer-disabled-report.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.test.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.ts, packages/plugins/plugin-webhooks/src/redeliver-guard.ts, packages/plugins/plugin-webhooks/src/webhook-delivery-real-sql-driver.test.ts, packages/plugins/plugin-webhooks/vitest.config.ts, packages/qa/dogfood/test/bare-name-one-holder-flow-family.dogfood.test.ts, packages/qa/dogfood/test/upgrade-18x-harness.dogfood.test.ts, packages/qa/dogfood/test/wall-declared-webhook-deployment-wide.dogfood.test.ts, packages/qa/dogfood/test/webhook-materialization.dogfood.test.ts, packages/runtime/src/dispatcher-plugin.ts, packages/runtime/src/domains/catalog-activation-door.test.ts, packages/runtime/src/domains/catalog-activation.ts, packages/runtime/src/domains/meta-qualified-item-read.test.ts, packages/runtime/src/meta-write-org-scope.test.ts, packages/runtime/src/route-ledger.ts, packages/services/service-messaging/src/objects/http-delivery.object.ts, scripts/check-test-source-alias.mjs, scripts/engine-double-contract.pinned.json + packages/plugins/plugin-webhooks/src/index.ts, packages/runtime/src/index.ts, packages/runtime/src/domains/catalog-activation.ts (read again for S3), and packages/plugins/plugin-webhooks/src/declared-webhooks.ts, packages/plugins/plugin-webhooks/src/redeliver-guard.ts and packages/objectql/src/ at the 18.3.0 tree badf24dff (the changeset's stated baseline)

① Derived judgments

• This is a delta over my PASS on 7f68e294 (6841104065). Inputs: epic ruling 6842178655, the delta request 6842991779, dev report 6842933276, the commits 7f68e294..c0500c639, the changeset and PR body at this head, and the head's check-runs. Nothing was built or run.
• The delta. 7f68e294 is an ancestor of the head; nothing was rebased. Four commits:
  • 40c798157: changeset text only.
  • a5c37e97c: merge of main 04c35f095; its remerge diff is empty, so nothing was resolved by hand.
  • 26a846fe7 and c0500c639: three test files and the changeset.
  • No source file moves; the PR's file list is the same 42 paths (+2046 / −288).
• Check-runs on this head: 60 success, 12 skipped, 0 failed, 0 pending. Every derived gate family is answered by them.
• The test hunks, each right:
  • database-loader.test.ts: metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791's CONTROL now iterates the types the boot pass reads, with the same filter and the same equality assertion the earlier blocks use. The new webhook CONTROL pins that the pass registers no webhook row and the bare read answers the package's row in either save order.
  • package-scoped-exact-qualifier.test.ts and webhook-stored-row-boot-hydration.test.ts: seven webhook pins move from "409 naming both" or "the row is the slot" to "the package-less item is declined, each holder answers its own". That is main's fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 reaching webhook; nothing is picked between holders, so red line 1 holds. The 409 FROM was never released.
• The Clause-②: line now counts seven. (5) is the conditional narrowing I asked for. (6) and (7) are new entries; the line is identical on the PR body and the changeset.
  • (6) is right, and my earlier reading was wrong. I read the 18.3.0 tree: its reader took the first listed declaration of a name from the registry listing, which hides a disabled package, and its redelivery guard asked that reader. So a declared:NAME redelivery beside a disabled holder was allowed in the last release, and is now refused.
  • (7) is declared and pinned. I did not verify its FROM (the row saved first); it rests on the dev's ablation R4-1.
  • The line is still one short (S6).
• The public-surface paragraph is now true. It names declaredWebhookRefId(name, packageId?) as the one export that moves and calls the rest internal, which matches both package entry points.

② Semver level

• Unchanged and right: minor on the seven packages, the ! marker, Clause-②: yes (narrowing) and Metadata-protocol: added on both the body and the changeset.
• The BREAKING banner now covers seven callers, each with its fix. The ADR-0087 marker is unchanged, and its check-run is green.

③ Boundary flags

• The missing dev report is posted (6842933276), covering 6b72041b..c0500c639 under both dev sessions. Its three open_questions:
  1. Whether bare GET /meta/webhook/NAME reaches the store read of (7) at its step 2: unmeasured, ruled to the p2 follow-up. I do not ask for the probe. The state needs a stored webhook row, which is residue, and no served reader of this PR calls that read. If the probe shows the door moves, (7) must name the door.
  2. metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692's residue stays on metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692, which blocks the card's close-out. Agreed; the changeset states what boot still does.
  3. Keep (6): yes, confirmed above.
• The p2 follow-up card has no number yet. The ruling, the body and the report all name it, and the report says "noted, not filed here". Five items ride on it (below). File it and cite the number before ACCEPT.
• Size: 2334 changed lines, under the 3000 cap.

④ Design judgment

Must-fix: none.

My five should-fix items

• S1 (sealed clash inside one namespace): ruled and declared; pin deferred. Ruling 6842178655 accepts it as built for 18.4.0 under ADR-0150 D4. The code is unchanged and matches the ruling. The Clause-② widening sentence and the Dispatch bullet now state the FROM, the TO and the two stops. The pin and an exact-qualifier door go to the unfiled p2 card.
• S2 (exports paragraph): fixed.
• S3 (all-disabled namespace): text fixed; pin deferred. The sentence now gives 404 only when nothing else serves the name, and 409 not-held-by-qualifier beside an enabled holder, which is what resolveQualifiedWebhook does. The co-holder pin goes to the unfiled p2 card.
• S4 (the conditional fifth): fixed. It is (5) in the line and in the banner.
• S5 (two platform-checklist items): deferred to the unfiled p2 card. Both files are unchanged at this head.
• Nits 4 and 5 are fixed in text. Nits 1 to 3 are deferred to the same card.

New should-fix

• S6. By the baseline the changeset now adopts, an eighth answer moves and the line does not name it.
  • The disabled co-holder bullet takes the last release (badf24dff, 18.3.0) as its baseline, and (6) is counted on it.
  • On that tree there is no one-holder rule: no bare-name-one-holder.ts, and no BARE_NAME_ONE_HOLDER_TYPES anywhere in package sources. Two packages could both declare a webhook name, the first registered was dispatched as declared:NAME, and a redelivery of its deliveries was allowed.
  • At this head, with both holders enabled, that redelivery is refused naming both. The Redelivery bullet gives this TO with no FROM, and the line counts only the disabled case (6).
  • The behaviour is ruled (Q3 = A on 6760178889, Q4 on 6813532941) and right. Only the declaration is short.
  • Fix, text only: widen (6) to any two holders, or add (8); give the Redelivery bullet its FROM.
• The same baseline makes the Dispatch bullet's "FROM neither subscribed" main's answer, where the last release dispatched the first registered holder. Say which baseline that bullet uses. This is a nit.

Per file in the delta. The three test files agree with the code they cite and with the rules main merged in (#32741, #32791). The changeset's exact-and-layered bullet and its boot-hydration sentence now match those pins. Every other file is as judged on 7f68e294.

Implemented-by: claude/project-thread-3giljf
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head 68145a9 · 2026-11-13T04:49Z

Delta review of S6 and its nit (changeset text only), by the same reviewer, at CONTRACT_REVIEW_TIER.

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 68145a92a397a1d451250386ab4acfa009780aeb
Local-runs: none
Scope: packages/core/src/package-scoped-resolution.test.ts, packages/core/src/package-scoped-resolution.ts, packages/metadata/src/loaders/database-loader.test.ts, packages/metadata/src/metadata-history.test.ts, packages/metadata/src/metadata-manager-action-slots.test.ts, packages/metadata/src/metadata-manager-keyed-plural-read.test.ts, packages/metadata/src/metadata-manager-match-endpoint.test.ts, packages/metadata/src/migrations/bind-database-loader-row-packages.test.ts, packages/metadata/src/package-slotted-store.ts, packages/objectql/src/bare-name-one-holder.ts, packages/objectql/src/package-scoped-e8-readers.test.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/objectql/src/package-scoped-read.ts, packages/objectql/src/package-scoped-resolver.test.ts, packages/objectql/src/registry-bare-name-one-holder-ai-family.test.ts, packages/objectql/src/registry-bare-name-one-holder-flow-family.test.ts, packages/objectql/src/webhook-stored-row-boot-hydration.test.ts, packages/plugins/plugin-security/src/upgrade-impact-report.test.ts, packages/plugins/plugin-security/src/upgrade-impact-report.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer-disabled-report.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts, packages/plugins/plugin-webhooks/src/auto-enqueuer.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.test.ts, packages/plugins/plugin-webhooks/src/declared-webhooks.ts, packages/plugins/plugin-webhooks/src/redeliver-guard.ts, packages/plugins/plugin-webhooks/src/webhook-delivery-real-sql-driver.test.ts, packages/plugins/plugin-webhooks/vitest.config.ts, packages/qa/dogfood/test/bare-name-one-holder-flow-family.dogfood.test.ts, packages/qa/dogfood/test/upgrade-18x-harness.dogfood.test.ts, packages/qa/dogfood/test/wall-declared-webhook-deployment-wide.dogfood.test.ts, packages/qa/dogfood/test/webhook-materialization.dogfood.test.ts, packages/runtime/src/dispatcher-plugin.ts, packages/runtime/src/domains/catalog-activation-door.test.ts, packages/runtime/src/domains/catalog-activation.ts, packages/runtime/src/domains/meta-qualified-item-read.test.ts, packages/runtime/src/meta-write-org-scope.test.ts, packages/runtime/src/route-ledger.ts, packages/services/service-messaging/src/objects/http-delivery.object.ts, scripts/check-test-source-alias.mjs, scripts/engine-double-contract.pinned.json + none

① Derived judgments

• This is a delta over my PASS on c0500c63. Inputs: the compare c0500c639...68145a92a, the changeset and PR body at this head, follow-up card plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016, and the head's check-runs. Nothing was built or run.
• The delta is text only. The compare is one commit ahead, none behind, with one parent: 68145a92a, which changes .changeset/31699-webhook-names-per-namespace.md alone (+4 / −4). No source, test or gate file moves, so every scoped path is as judged on c0500c63.
• Check-runs on this head: 60 success, 12 skipped, 0 failed, 0 pending. Every derived gate family is answered by them.
• The Clause-②: line now counts eight and is complete against the 18.3.0 baseline. (8) names the redelivery of a declared:NAME delivery under two enabled holders: FROM judged as the first registered holder's, TO 409 DELIVERY_NOT_ELIGIBLE naming both. That matches the 18.3.0 reader I read last round and judgeDeclared at this head. The line is identical on the PR body and the changeset.

② Semver level

• Unchanged and right: minor on the seven packages, the ! marker, Clause-②: yes (narrowing) and Metadata-protocol: added on both the body and the changeset.
• The BREAKING banner now names eight callers; the fix it gives for (6) covers (8) as well (remove one of the two holders).

③ Boundary flags

• The follow-up card is filed: plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016 (open, p2, server lane, parent objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699). It carries all five deferred items: the S1 pin and exact-qualifier door, the S3 co-holder pin, S5 (both checklist items, by file and line), and nits 1, 2 and 3. It also carries the unmeasured GET /meta step 2 question and the nit 4 pin.
• No dev flag or open question is new in this delta. metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 and plugin-webhooks: a ledger row naming a package that no longer declares a webhook switches the remaining holder, and the 18.x ownership ceremony falls back to the first-listed holder (ADR-0150 D4/D8) #32695 stay as recorded.

④ Design judgment

Must-fix: none.

Should-fix: none open.

• S6: fixed. (8) is in the line and in the banner, and the Redelivery bullet now gives the FROM for both (8) and (6).
• S6's nit: fixed. The Dispatch bullet says its two "neither subscribed" FROMs are main's since webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677, and that the last release dispatched the first registered holder alone as declared:NAME.
• S1 to S5 stand as recorded on c0500c63: S2 and S4 fixed; S1 ruled and declared; the S1 and S3 pins, S5 and nits 1 to 3 deferred to plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016.

The changeset now agrees, sentence by sentence, with the code it describes at this head.

Implemented-by: claude/project-thread-3giljf
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgXQnNkXTT1Wu7i7Y3i

ACCEPT · 2026-11-13T05:12Z

Head-sha: 68145a92a397a1d451250386ab4acfa009780aeb · Tier S. The diff is 42 files, +2046 −288 = 2334 lines, under 3000, and no governed path moved since the reviewed heads. This replaces the void ACCEPT 6838022149.

• Shape. One card, objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 2 of 3 (webhook family). The changeset and body declare Clause-②: yes (narrowing) with eight moved answers and the named widenings, Metadata-protocol: added, and the ADR-0087 marker not-required (no-migration-prescription). Body r7 is applied, 59792 bytes, read back identical.
• Contract review on this head. triage#1 at CONTRACT_REVIEW_TIER: full review PASS 6841104065 on 7f68e294, delta PASS 6843291373 on c0500c63, delta PASS 6844735688 on 68145a92 (this head). No must-fix, and no should-fix left open. Epic ruling 6842178655 rules S1 and the missing dev report. Dev report 6842933276.
• Premises measured. The merge-forward red-line read 6840474902 is a PASS with nits. The commits since 7f68e294 move no source: changeset text, one merge from main (remerge-diff empty), and test repins to metadata: a stored row bound to the host package is counted as two holders (host package + environment) in the bare action read's loader judgement (regression of #32560 / PR #32719) #32791 and fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741, each with its FROM.
• Gates. CI on this head: 60 success, 12 skipped, 0 failed, on merge ref ea2a8ed8 (main 994c7d67, with fix(metadata): unregistering the host package keeps the environment's own object, view, app, hook and dashboard rows #32999).
• Main. PRBASE 994c7d673 is that run's Affected-set diff base. K = 5 first-parent commits behind, under 15, and no new language pack has landed since. The merge queue re-runs CI on the merged result.
• Accepted deviations. Epic rulings R3 (6820856607) and 6842178655. The deferred items are on p2 card plugin-webhooks: follow-ups of PR #32577 — pin and door for two webhook holders that still meet in one namespace, the disabled co-holder pin, two checklist items, liveness and impact-report nits, GET /meta step 2 (ADR-0150 D4) #33016: the S1 and S3 pins, the S1 door, S5, nits 1 to 3, and GET /meta step 2.
• Out of scope. objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 PR 3 and metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 (p2, after 18.4.0) are not started by this lane.

Land: ready + auto-merge.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 43370657646 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Dogfood Regression Gate (1/3) — 失败步骤: Boot example apps and exercise real user flows

  @objectstack/dogfood:test:  FAIL   isolated  test/security-catalog-showcase.dogfood.test.ts > showcase, 'single': the security catalog read > permission: lists exactly the declared names
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  @objectstack/dogfood:test:  FAIL   isolated  test/security-catalog-showcase.dogfood.test.ts > showcase, 'single with the Default Organization': the security catalog read > permission: lists exactly th
    ↳ 失败原因: (这条 FAIL 之后 12 行内没有可识别的原因行 —— 点进 job 看)
  @objectstack/dogfood:test:  FAIL   isolated  test/security-catalog-showcase.dogfood.test.ts > showcase, 'walled': the security catalog read > permission: lists exactly the declared names
    ↳ 失败原因: @objectstack/dogfood:test: AssertionError: expected [ 'admin_full_access', …(18) ] to deeply equal [ 'admin_full_access', …(17) ]
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/security-catalog-showcase.dogfood.test.ts — 24h 内已弹出 3 个 PR（feat(plugin-webhooks)!: declared webhooks are held per namespace, each holder dispatched and switched as its own (ADR-0150 child B, webhook family 2/3) #32577、fix(service-storage, plugin-security): every member can attach files to the records they edit — storage contributes its own attachment set to the member baseline #32932、fix(app-shell): the model picked in the AI assistant composer is the model the chat request sends, from the first message on #33024），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: test/security-catalog-showcase.dogfood.test.ts #33037（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 16 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)