[objectstack-fleet]

Requested by Sales · project thread

Supersedes #32557 (same work; its branch claude/project-thread-3e08el could not be pushed from this container). Its review history stays there: review records 6815300751 and 6815340803.

Fixes #32408

Follow-up: #32561

Clause-②: yes (narrowing) — two refusals where a registration was admitted before. First (row 1), with the bare-name holders sealed, a package whose only members of an email template's name are locales the App ships none of, while the App's pair stores a row of that locale declaring another package of the App (overrides.package), is refused naming the App as an addition to the App's template, where it was admitted because the pair's row counted as the App's own member. Second (row 13), with the holders sealed, a package of another namespace on a package X that holds an email template's name alone (or one that X's dependencies reach), shipping only a locale X ships none of, while a package-less row of that locale (a legacy overlay in the environment's slot) customizes X's template, is refused naming X as an addition to X's template, where it was admitted because that row counted as X's member; once admitted, the row bound to neither package and the cold boot's seal reported the package. First-party packages in either position: 0. The previous head's admission beside X (row 12) is withdrawn (epic ruling 6838245909, option B): where a row of the App's pair now binds to X, the bare-name gate lends X no locale, so a package of another namespace on X shipping only that locale is refused and reported as on main, in either registration order; admitting it is #32899. Beside them, a read withholds a row it served: with every package of the App that holds the name disabled, a row of the App's pair is that disabled holder's, so the bare read and an addition's address withhold it as they withhold any name only disabled packages hold (rows 10 and 11). Every moved answer is in the table below and in the changeset.
Metadata-protocol: narrowed
Skills-docs: none — no file under skills/** or content/docs/ describes how a customization pair's row binds in the registry; ADR-0146 D2/D3 and the epic's ruling on #31699 F2 already state the rule this PR makes every reader follow.

维护者速读

• 改了什么：App 的定制包（APP.custom）里存的一行，注册表的其余读者（持有者集合、bundle 成员、按包读取、环境项）现在和精确读（?package=）用同一条归属规则判它归谁：行声明了 overrides.package → 只归它；没声明时 App 自己持有 → 归 App；App 内只有一个包持有 → 归它；两个以上 → 谁也不归。
• 为什么改：ADR-0150 D4。以前只按 pair 的前缀找 base，pair 自己变成第三个「持有者」让裸读误报 409，或把声明给 X 的行算成 App 的。
• 风险与回滚：新拒绝是两处安装窄化（第一方都是 0 个），同一条 ADR-0087 语义条目登记两处（id 不变）：第 1 行（pair 行声明给 X 的 locale，不再算 App 的）和第 13 行（环境槽里没有包戳的旧覆盖行；来者只出这个 locale，两道门现在把来者算作已登记，这行谁也不归，来者成了对 X 模板的追加，拒 422 点名 X；以前放行之后 X 丢了这行、冷启动 seal 报它）。上一版的第 12 行放行已按专题裁定 6838245909（B）撤回：裸名门读持有者成员时，pair 行只在按包读法也给同一持有者时才算数，所以 X 在门上拿不到这个 locale，W 在两种注册顺序下都和 main 一样被拒、被 seal 报告；放行改由 metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899 在按名读跟随绑定之后再做。合 main 后与「停用包不持有名字」（fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497）组合多出两处随之而来的答案（全部持有者停用时裸读不再给出这行），已声明并钉测；三处注册表答「无包」而精确读照给的残余分歧交 metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561；回滚即 revert。
• 先看：packages/objectql/src/registry.ts 的 pairRowBinding / settledPairRowBinding / ownersHoldingAName，以及裸名门自己的读法 gateSlotBinding，再看 changeset 的 FROM → TO 列表。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/package-scoped-resolver.test.ts src/package-scoped-exact-qualifier.test.ts，预期全部通过。
• 合同评审 6835646675 的回应：F1（语义条目第三条补救会被保存门拒）已删；F2 实测成立，当时补了第 12 行与 pin（本轮已撤回，见下），并修了它暴露的热路径/冷启动不一致；F5 表格第 10、11 行补了 Clause-② 臂；F3、F4 按席位记为接受偏差（见验收说明）。
• 增量评审 6837360468 的回应：N1 实测复现，保留到达计数，第 13 行在 changeset 的 Clause-② 行和 FROM → TO 里声明为窄化，三道门各钉一个 pin（去掉到达计数，两道门的 pin 变红），语义条目扩写了这一处（两条补救都在门上实测过）；N2 的形状（够到两个 App 的包）走裸名门的同一读法，和 main 一样被拒，它的 pin 在 metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903 第 4 条。
• 专题红线复读 6838271054 与裁定 6838245909 的回应：席位选 B（6838268615），撤回第 12 行，三种形状、三道门、两种注册顺序都钉了 main 的答案；必修 3 因此由 seal 在反向顺序也照 main 报告而关闭；必修 1 即 N1。按名读四格交 metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899，两条旧缺陷交 metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900（p1）和 metadata-protocol: the item door judges a package member by member, so the package's own member order decides admission #32901（p2），nits 交 metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903。
• 增量红线读 6841098779（HOLD，仅文字）的回应：H1 在第 13 行、changeset 的第二处拒绝和条目的 surface 各补了镜像方向（X 的依赖触达到达包，同样拒绝、同样补救、同一条目）；H2 在第 3 行和 changeset 的 packageScopedHoldersOf 一条补了半句（pair 行 L 声明给 X，W 是 App 的包、带 L 和一个 X 也有的 locale，W 停用时 L 的裸读由 409 变为扣下，不算放宽）。代码与测试未动。
• 本 PR 取代 fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32557：同一份改动，换到本线程分支续做（原分支从本容器推不上去）；fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32557 上的评审记录照旧有效。
• 需要你做的：无，席位落地。

What the card asked, measured (step 1)

Measured on 27abd458a8 (PR #32214's final head), App A (type: app) with packages X, Y (type: module, each declaring A), and a row stored in A.custom hydrated into the registry's bare slot:

Case	overlaySlotBinding (BASE)	bundleMembersHeldBy X / Y / A / pair (BASE)	getEnvironmentScopedItem (BASE)
X, Y hold; row declares X	the pair itself	en-US / en-US / — / fr-FR (the row is X's on no reader)	undefined
X, Y hold; no declaration	the pair itself (a third holder)	en-US / en-US / — / fr-FR	undefined
X holds; no declaration	the pair itself (a second holder)	en-US / — / — / fr-FR	undefined
A, X hold; row declares X	A	en-US / — / en-US, fr-FR / — (X's row counted as the App's)	undefined
A, X hold; no declaration	A (#28390 ruling A)	en-US / — / en-US, fr-FR / —	undefined

Both readers bound the row without reading overrides.package, and the binding never looked through the App (isPairOf): it read the pair's per-package base (customizationBasePackageId) only. getEnvironmentScopedItem never served a pair's row in any case, before or after: its reach is none.

What changes

SchemaRegistry#overlaySlotBinding (packages/objectql/src/registry.ts) asks a new pairRowBinding for a row stored in a customization pair when some holder of the name is a package that pair customizes (isPairOf, @objectstack/metadata-core). It reads the row the way the exact read's one owner check does (pairRowOnAddress, @objectstack/metadata-protocol): the declared holder when the pair customizes it, else the App whose own pair it is (#28390 ruling A), else the one owner, else no package.

• Owners are counted as the exact read counts holders (packageScopedHoldersOf), over every holder of the name with every row bound to it (ownersHoldingAName): a bundle addition to another holder, of the App or outside it, holds no name (metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802); a package a row of the pair is declared for holds that row's locale; the undeclared rows of the pair being decided are left out (settledPairRowBinding splits them off). An addition that ships the row's own locale stays an owner, since the row may customize that package's member.
• When the count would read an undeclared row of another shared pair, the row binds to no package (epic seat 1's ruling: no guess, no fixed point).
• Every holder is counted, a disabled one included: a binding never moves with a reversible disable (ADR-0150 D3, objectql + metadata-protocol + runtime: by-name doors judge a name's holders over the served list, so a disabled package neither refuses nor is named (ADR-0150 D3; #32101 F4 class) #32183, merged with this branch). The served filter applies after the binding, in packageScopedHoldersOf.
• A declared package the pair's holders do not include binds the row to no package. A pair no holder is customized by keeps the per-package reading, so every one-holder and legacy per-package-pair case binds as before. The registry imports the pair lookup from @objectstack/metadata-core; it does not import @objectstack/metadata-protocol.
• The bare-name gate reads a pair row its own way (epic ruling 6838245909, option B). Both doors and the cold boot's seal read a holder's members through registeredBundleHolding, which now reads a bare-slot row through gateSlotBinding: the binding above, except that a row of a customization pair counts for a holder only where the per-package reading (the pair's base when it holds the name, else the pair itself) counts it for that holder too. Where the binding moved the row (to X, from the App or from the pair), the gate counts it for no holder. The App no longer holds a locale it shipped none of through a row declared for X (row 1); X does not gain the row's locale either, so a package of another namespace on X shipping only that locale stays an addition to X's template, refused at both doors and reported by the seal in either registration order, as on main (row 12, withdrawn). The reads keep the binding. Admitting that package waits on the by-name read following the binding (metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899): in that state the protocol's by-name read answers by registration order (red-line read 6838271054, "For the epic seat" item 2).
• The doors read a holder's members as if the arriving registration were registered (contract review 6835646675 F2, delta review 6837360468 N1). registeredBundleHolding takes the arrival (BundleArrival: the members the registration adds) and reads the holder's members over a copy of the collection with those members in the arriving package's composite slot; both doors pass it (registerItem's gate, refuseBareNameConflicts), and the seal reads the registered state. Under the gate's reading above it moves one answer, the package-less row's (no package stamp, or sys_metadata): such a row binds to the one composite holder of the name only while there is exactly one, so beside the arrival it binds to neither and the arrival's locale is an addition to X's template (row 13), as the seal already read it. The previous head also lent the incoming manifest to the pair-row binding at the package door. Under the gate's reading no pair row's count moves with the arrival, so that part is removed: ablated at the B code it turned nothing red (396 of 396 green over the two harness files and registry-bare-name-one-holder.test.ts).
• The four readers (packageScopedHoldersOf, bundleMembersHeldBy, getPackageScopedItem, getEnvironmentScopedItem) share the one binding; the bare-name gate's member count (gateSlotBinding, above) is the one place a pair row is read otherwise, and only to withhold a member. After the merge with main (two commits moved registry.ts since the branch point: fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 and feat(core, metadata, objectql, metadata-protocol)!: picklist, mapping, dataset, API and function names are held per namespace (ADR-0150 child B) #32513), overlaySlotBinding is still the only binding of a bare-slot row in the registry: fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497's served filter applies after it inside packageScopedHoldersOf (and its includeDisabledPackages read keeps every holder), and feat(core, metadata, objectql, metadata-protocol)!: picklist, mapping, dataset, API and function names are held per namespace (ADR-0150 child B) #32513's picklist re-judge reads holders through resolvePackageScopedName, so through packageScopedHoldersOf. No reader on the merged tree binds a pair row a second way.
• Upgrade guide: the semantic entry pair-row-locale-addition-refused (packages/spec/src/migrations/entries/semantic/18.pair-row-locale-addition-refused.ts), registered by the changeset (adr-0087: registered pair-row-locale-addition-refused), with its own @objectstack/spec patch changeset. It names two remedies: ship a locale the holder ships too (the App, or X for the package-less row), or rename the template; the third one an earlier head named (drop the row's declaration, or declare the App) is gone, since the save door refuses both in the case the entry names (contract review F1). This round extends the same entry, id kept, to the package-less row (row 13): its surface, replacement, reason and acceptanceCriteria name both narrowings, and its reason says the gate no longer counts the pair row as the App's. Both remedies were measured at both doors for both shapes on the B code (scratch probe, not committed): renaming the template is admitted at the item door and the package door; shipping a locale the holder ships too is admitted at the package door in either member order, and at the item door when that shared locale registers first, while registering the L-only member first is still refused, so the entry says so. No automatic rewrite: which locale a package ships, and which base a pair row customizes, are judgements about that package and that row.

Branch note (Duplicate Fix Guard): this PR replaces #32557. Its branch claude/project-thread-iv3vz6 is this card thread's, which the platform assigns; it carries the whole history of #32557's branch claude/project-thread-3e08el (head 075fb318), then origin/main merged in (7bea2a2ae) and the landing commits on top, never rebased, never force-pushed. 3e08el is not pushable from this container. Since that merge main gained #32742 (its registry.ts change is the permission-set namespace claim only, no reader of a pair row), #32793, #32797 and #32801; a trial merge (git merge-tree) is clean, and the merge queue tests the merge.

FROM → TO

Re-measured on the merged tree (head acc680227, origin/main 2f80f2897 merged at 7bea2a2ae): with the binding ablated (the per-package reading put back) every binding pin answers its FROM below; restored, its TO. Rows 10 and 11 are new on the merged tree: they follow from row 2 meeting main's served holder set (#32497). Row 12, contract review F2's mirror of row 1 that the previous head admitted, is withdrawn (epic ruling 6838245909, option B): its shapes keep main's answer in both registration orders and are pinned so. Row 13 is delta review 6837360468 N1: the doors' arrival count (not the binding) moves it. Its mirrored direction, where X's dependencies reach the arriving package, moves the same way: the delta red-line read 6841098779 measured it (H1; main admits, the head refuses naming X, both stamps, both doors), and the changeset and the entry's surface name it. Row 3's exception with a disabled arrival is that read's H2.

#	Surface	FROM	TO	Clause-② arm	Pinned in
1	Bare-name gate (registerItem / install, holders sealed): a package with only a locale the App does not ship, while the App's pair overrides that locale for X	admitted (the pair's row counted as the App's member, so no addition)	refused NAMESPACE_CONFLICT naming the App (#28802 addition rule)	narrowing	resolver harness, NARROWING — a later package whose only locale…
2	packageScopedHoldersOf: the App holds no item of the name	the pair counted as a holder of its own	never a holder	— (feeds 3, 4, 10, 11)	bound to X → only X, unbound with two…, unbound with one…
3	Bare read (GET /meta/TYPE/NAME, resolvePackageScopedName), one served package of the App holds the name	409 ambiguous-in-environment naming X and the pair	the row (X's customization), or X's own item when the row declares a non-holder; two real holders still refuse; with the row (of locale L) declared for X and a package W of the App holding the name through L and a locale X ships too, W disabled, the bare read of L is withheld (FROM 409; no loosening)	widening (epic seat 1: a corrected false 409)	unbound with one package…; CONTROL — two real holders…; the door probe below
4	Bare read and ?package=A refusals, two packages of the App hold the name	409 naming X, Y and the pair	409 naming X and Y	— (candidate list)	unbound with two packages…
5	getPackageScopedItem(X): row declares X, or X is the one owner	X's own shipped item (none for an added locale)	the row, what ?package=X already served (outside the residuals below)	—	bound to X → only X, bound to X beside the App…, bound to X, a bundle member…, unbound with one…
6	getPackageScopedItem(A.custom)	the row	none (the pair is no holder; ?package=A.custom still serves the row)	—	unbound with two…
7	A holder's bundle members (bundleMembersHeldBy): row declares X	counted as the App's (or the pair's)	counted as X's	— (feeds 1)	bound to X, a bundle member…
8	?package=A, row declares a package that holds no item of the name	the row (the exact read fell back to A's registry item, which was the row again)	A's own item	— (semantic)	a row declaring a package that holds no item…; the door probe below
9	getEnvironmentScopedItem	undefined	undefined	— (unchanged, measured)	every case asserts it
10	Bare read of the row's member, every package of the App holding the name disabled (two holders, or one)	the row (the pair an enabled holder of its own)	the disabled holder's withheld item, as for any name only disabled packages hold (ADR-0150 D3)	narrowing (a read withholds a row it served)	exact-read harness, [#32408, #32183] a row of the App's pair is bound over every holder…, [#32408, #32183] a row of the App's pair bound to its one holder…
11	?package=Z, Z of the App an addition to the row's one holder X, X disabled	the row	X's withheld item (the address reads the disabled base)	narrowing (a read withholds a row it served)	[#32408, #32183] a row of the App's pair bound to its one holder…
12	(withdrawn) Bare-name gate (item door, package door, cold boot), the App holding no item of the name: a package W of another namespace whose dependencies reach X ships only locale L, while a row of the App's pair of locale L binds to X (it declares X, with W of the App or outside it; or X is its one owner, with W outside the App); and the reverse order, W holding L first, then X arriving	refused 422 NAMESPACE_CONFLICT naming X, and the seal reports W against X; reverse order: X refused naming W, and the seal reports X against W	unchanged: the gate lends the row's locale to no holder (the previous head admitted W at both doors, and its seal reported nothing in either order)	— (withdrawn; #32899)	resolver harness, ROW 12 WITHDRAWN (epic ruling B), … and REVERSE ORDER (epic red-line read must-fix 3), …, three shapes at three doors each
13	Bare-name gate (item door and package door, holders sealed): X holds the name alone, a package-less row of locale L (no package stamp, or sys_metadata) customizes X's template, and a package of another namespace whose dependencies reach X (or that X's dependencies reach) ships only L	admitted (the row counted as X's member, so no addition); after it, the row bound to neither package, X's address no longer served it, and the seal reported the package against X	refused 422 NAMESPACE_CONFLICT naming X (an addition to X's template); X keeps the row; the cold boot's seal reports the package against X, as before	narrowing	resolver harness, NARROWING (delta review N1), item door / package door / cold boot

Unchanged at the doors (contract review F2): the same package of the App beside an undeclared row of L that X is the one owner of is refused (and reported at the seal) as before, and X keeps the row: the gate lends the row's locale to no holder (UNCHANGED at the door (contract review F2), …). Delta review N2's shape (a package reaching two Apps whose namespace picks another, or none) takes the same reading: an App pair's row counts at the gate only for the holder the per-package reading names, which no arriving package's App moves; it is not pinned here (#32903 item 4). The same package declaring X's namespace is refused before and after.

Unchanged, measured on the protocol (getMetaItem) for the same cases: ?package=X, ?package=Y, ?package=A.custom, and ?package=A outside row 8, serve or refuse as before; the App's own address keeps an undeclared row of its pair (CONTROL — the App's own address keeps #28390 ruling A).

Tests

• packages/objectql/src/package-scoped-resolver.test.ts (the shared harness): one describe, 38 cases. New in this round, 21: NARROWING (delta review N1) at the item door, the package door and the cold boot's seal (row 13); ROW 12 WITHDRAWN (epic ruling B) and REVERSE ORDER (epic red-line read must-fix 3), each in three shapes (a row declaring X with W of the App, the same with W outside the App, an undeclared row X alone owns with W outside the App) at the same three, in place of the previous head's three WIDENING pins. From the previous round, three: UNCHANGED at the door (an undeclared row X is the one owner of, W of the App). The other 14: The card's three pins (bound to X → only X, with and without the App holding, and as a bundle member; unbound with two → neither; unbound with one → that one), the narrowing, the declared non-holder, the ruling-A CONTROL, the epic seat's CONTROL (two independent holders still refuse the bare read, with or without a pair row beside them), contract review F1's pair and its CONTROL, F4's two (b and a), and F6's CONTROL.
• packages/objectql/src/package-scoped-exact-qualifier.test.ts (its objectql: narrow the phase-1 one-holder refusal from environment to namespace for webhook, connector and email_template (ADR-0150 child B, webhook family) #31699 F2 describe): the F1 case read through ?package=X, served there and bound to X by the registry alike; the F4 (b) case, refused at ?package=X naming X and the addition, and bound to no package alike. New on the merged tree, two cases: one of two holders disabled, ?package=X serves the row while the registry binds it to no package (CONTROL, residual 3), then both disabled, the bare read withholds it (row 10); a row bound to its one holder, disabled, withheld at the bare read and at an addition's address (rows 10, 11).
• Ablations on the final head (scripts/ablation-replace.mjs, at acc680227, the two harness files, 306 tests; each mutation landed (anchor 1 → 0) and each restored by the tool, blob equal to HEAD 0777d5ee621d and git diff HEAD empty):
  • The gate's own reading removed (return bound === perPackage ? bound : undefined; replaced by return bound; // ABLATED #32408 B, so the gate reads the binding as the reads do): 13 failed / 293 passed. The nine ROW 12 WITHDRAWN pins (each package admitted, or at the cold boot nothing reported), the three cold-boot REVERSE ORDER pins (nothing reported), and the package-door UNCHANGED pin (without the gate's reading, the package door judges before the arriving package is installed, so the binding does not yet count it an owner of the pair and the undeclared row stays X's). The item-door and package-door REVERSE ORDER pins stay green: the doors refused X naming W on main and at the previous head alike.
  • The doors' arrival count removed (opts.incomingArrival && { packageId: incomingPackageId, ...opts.incomingArrival }) replaced by undefined) // ABLATED #32408 N1): 2 failed / 304 passed, exactly the item-door and package-door NARROWING (delta review N1) pins (each package admitted). Under the gate's reading the UNCHANGED door pins no longer hang on the arrival; the cold-boot pins stay green, as the seal reads the registered state. Under the same ablation a scratch probe of row 13 (both stamps: none and sys_metadata) read its FROM cells: admitted at both doors, X's address no longer serving the row afterwards, a second seal reporting the package against X; at the head the probe reads the TO cells (refused naming X, X keeping the row, the reseal empty).
  • The binding put back to the per-package reading (the anchor below): 22 failed / 284 passed: every binding pin, the item-door and package-door UNCHANGED and ROW 12 WITHDRAWN pins on their X keeps the row cells (row 5's TO; each refusal holds), and none of the cold-boot or REVERSE ORDER pins, whose answers are main's.
• Ablations on the previous rounds' code: at 7509d920b (288 tests), binding 19 failed / 269 passed and arrival count 2 failed / 286 passed (the two door UNCHANGED pins); at 58a13fd61 (291 tests), binding 19 / 272 and arrival count 4 / 287 (the two door UNCHANGED pins and the two door N1 pins). The incoming manifest the package door lent the pair-row binding, ablated at 3b168f1ba (the B code before its removal), turned nothing red over the two harness files and registry-bare-name-one-holder.test.ts (396 of 396 green).
• Ablation on the round-2 head (e94a8de8f): const paired = this.pairRowBinding(type, stamped, item, name, collection, composite); replaced by const paired = NOT_A_PAIR_ROW_OF_A_HOLDER; // ABLATED #32408 (the per-package reading put back), mutation landed (anchor 1 → 0, blob e84fc254dea3 → 50f62a28a05c). The two harness files: 14 failed / 268 passed of 282 — every binding pin red, the two new disable pins included; the controls stay green (ruling A, two independent Apps, F1's CONTROL, F6's CONTROL). Restored by the tool: blob equal to HEAD (e84fc254dea3), git diff HEAD empty. The FROM cells of rows 3, 4, 10 and 11 at the door were read under the same ablation (at 6d317e68b, the binding code identical) through a scratch protocol probe of the same shapes (not committed): bare read 409 naming X and the pair (row 3), 409 naming X, Y and the pair (row 4), the bare read and ?package=Z serving the row with every holder disabled (rows 10, 11). At the head the same probe reads every TO cell of those rows, and row 8's ?package=A answers the App's own item (its FROM is the earlier rounds' door measurement).
• Earlier rounds (on 075fb318, before the merge): the full ablation 12 failed / 207 passed of 219; F1, F4 and F6 ablated each at their own head, each pin red (records 6814943264, 6815176250, 6815340803).

Acceptance notes

• Residual divergence, accepted by the seat and the epic seat (red-line read 6814925975: the registry is the side that does not guess), carried by metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 (the exact read adopts the registry's count). Three shapes; in each the registry binds the row to no package while the exact read serves it:
  • (1) An undeclared pair row of the very locale a bundle addition of another package of the App ships. Pinned as a CONTROL on the registry side.
  • (2) Contract review F6, per epic seat 1's ruling: a pair's undeclared row while another shared pair stores an undeclared row of the name. Pinned as a CONTROL.
  • (3) New on the merged tree: an undeclared row of a pair two holders share while one of them is disabled. The registry counts every holder (a binding never moves with a disable); the exact read counts the served holders, so ?package=X of the enabled one serves the row (the bare read serves it too, through the protocol's stored-row read). Pinned as a CONTROL in the exact-read harness.
• The card's surface guess (packages/metadata) was wrong: both readers are in objectql's SchemaRegistry. getEnvironmentScopedItem is never reached by a pair row (reach none).
• overrides.package naming a package the save gate would not accept (a non-holder, or one the pair does not customize) is off-door data; such a row now binds to no package instead of to the App or the pair.
• Accepted deviations (contract review 6835646675, the seat's call):
  • F3: the Clause-② line and the entry's surface leave out two conditions the refusal needs (the package reaches the App through its declared dependencies, and it declares another namespace than the App). The text over-declares, on the safe side.
  • F4: the cold boot's seal reads the same members. Measured in a scratch probe, row 1's shape with every item registered before the seal: FROM no conflict TO two (X against the App, and the later package against the App). BARE_NAME_COLD_BOOT_MODE is warn, so the boot logs them and refuses nothing; X re-registering its item after the seal is admitted (it already holds the name). X is listed because, without the pair row lending the App its locale, X shipping only a locale the App ships none of is itself an addition to the App's template under the metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802 rule main applies.
• Routed by the epic ruling 6838245909 and the seat (6838268615): the admission beside X and the by-name read's four cells (red-line read item 2) → metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899 (p2); the bare slot keeping only the row hydrated last → metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900 (p1); the item door judging a package member by member → metadata-protocol: the item door judges a package member by member, so the package's own member order decides admission #32901 (p2); the nits, delta review N2's pin among them → metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903. The disabled-X cell is not a disclosure (ruling item 4) and is not reachable through the doors under B.
• Line budget: +763 / -26 over 6 files (789 changed lines, merge base 2f80f2897): registry.ts +266 / -26, the resolver harness +338, the exact-read harness +64, the changeset +29, the semantic entry +56, its changeset +10; under the ~1500 order cap and the 3000-line threshold; 0 governed paths (check-governed-merges --branch HEAD).

Verification

Text-only round on head 463a1752b (delta red-line read 6841098779, H1 and H2): the changeset and the semantic entry edited, the code and the tests unchanged since acc680227. On 463a1752b: @objectstack/spec rebuilt, pnpm --filter @objectstack/spec check:generated all 14 generated artifacts up to date, node scripts/check-adr-0087-registration.mjs --base origin/main exit 0, node scripts/check-nul-bytes.mjs OK. Everything below was measured on acc680227.

Measured on head acc680227 (origin/main 2f80f2897 merged at 7bea2a2ae, never rebased; main not merged this round), after the earlier rounds' full pnpm install --frozen-lockfile, pnpm build (119/119 tasks, with declarations) and dogfood closure build, then @objectstack/spec and @objectstack/objectql rebuilt for this round's source changes (the spec src/migrations/ suites: 5 files, 198 tests passed):

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 94 families derived on the 6 paths (the same list as the previous heads), each run with its exit code captured before any pipe: 94/94 exit 0. --ran on the record: 94 derived, 94 run, 0 NOT-MEASURED, 0 UNRUN, a derived zero (every line carries its exit code). node scripts/check-nul-bytes.mjs: OK.
• node scripts/check-adr-0087-registration.mjs --base origin/main: exit 0, registered pair-row-locale-addition-refused (new here). pnpm --filter @objectstack/spec check:generated: all 14 generated artifacts up to date.
• pnpm lint: exit 0. pnpm --filter @objectstack/objectql typecheck: exit 0.
• pnpm --filter @objectstack/objectql test: 589 files passed; 12633 tests passed.
• Dogfood battery (pnpm --filter @objectstack/dogfood test under scripts/pm/os-verify-lock.sh, no shard, no path, at acc680227): 455 files passed, 3 skipped; 3817 tests passed, 42 skipped; VERDICT command-exit 0.
• node scripts/pm/check-governed-merges.mjs --branch HEAD: 0 of 6 paths governed. dispatch-gates --tier: no path-derived mandate (the semantic entry under packages/spec makes the review face packages/spec, CONTRACT_REVIEW_TIER by surface).

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic (one migration entry).
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes on the final head.
• 4. One issue, one branch, one pull request (this PR replaces fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32557; its branch carries that PR's whole history, merged with main).
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: one entry file; the registry, spec-changes.json and the upgrade guide are generated, git-ignored projections (check:generated all up to date).
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

Development by the os-dev session session_01Utp6CbGpwJzMFhChu9a91Q (PR #32557); main merge and landing round by the card thread session_01L6bhgUJkevgE12tpg42pZA for the seat domain:server#1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L6bhgUJkevgE12tpg42pZA

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: acc6802279cf88f7424df53e974e0fd3a83de5eb
Local-runs: none
Scope: packages/spec/src/migrations/entries/semantic/18.pair-row-locale-addition-refused.ts + packages/objectql/src/registry.ts + packages/objectql/src/package-scoped-resolver.test.ts + .changeset/32408-pair-row-binding-every-reader.md

Delta round on record 6837360468 (head c3cc324b1): the diff c3cc324b1..acc680227 (5 commits, 4 files, +171/−90, no merge of main) and the PR body r4, judged against epic ruling 6838245909 option B. Read outside the diff, never reviewed: overlaySlotBinding, settledPairRowBinding, withArrivingMembers, bareNameHoldersOtherThan, sealBareNameHolders, isBundleAdditionPair. Every trace is a static read; nothing was built or run. The ablation counts and suite totals are the thread's report, relayed.

Check-runs on this head when read: 57 success, 13 skipped, 1 in progress, no failure. This verdict is the contract's; it does not cover the run not concluded.

Earlier findings

• N1: closed, declared and pinned. The arrival count is kept. The changeset's Clause-② line now counts two refusals and names the second (a package-less row of locale L over a name X alone holds; a package of another namespace on X shipping only L: FROM admitted at both doors TO 422 naming X; the seal unchanged), with a FROM → TO bullet, the BREAKING paragraph, body row 13, and "First-party packages in that position: 0" on each. The entry's surface, replacement, reason and acceptanceCriteria carry the same shape under the one registered id. Pins: NARROWING (delta review N1) at the item door, the package door and the seal. By trace the two door pins are admitted without the arrival (one composite holder, the row is X's, the arrival shares L) and so go red, matching the reported 2 red of 306; the seal pin does not hang on the arrival, as reported.
• N2: moot under B. The gate lends a pair row's locale to no holder where the binding moved it, so the package that reaches two Apps is refused as on main; the sentence it contradicted is gone from the changeset.

① Derived judgments

• Row 12: withdrawn in the code, not only in the prose. gateSlotBinding returns the binding only when it equals the per-package reading (the pair's base when it holds the name, else the pair, which is never a composite holder). With the App holding no item of the name, a pair row therefore counts for no one at the gate, declared or not, whatever arrives: X holds only what it ships, and W shipping only L is an addition to X. Refused naming X at both doors, reported against X by the seal: the answers of main, for the three shapes pinned.
• Reverse order (red-line must-fix 3): closed. W holds L first, X arrives with its own locale: W's gate members are L, X's are its own, W reaches X, no member in common: the doors refuse X naming W and the seal reports X against W, as on main. Pinned in three shapes at three gates.
• Row 1 kept: right. The App held L on main through the per-package reading; the binding now gives the row to X, the two readings differ, the gate counts it for no holder, and the later package is an addition to the App.
• Row 13: right (N1 above). gateSlotBinding passes a package-less row straight to overlaySlotBinding.
• Nit. A row declaring a package that holds no item of the name, or one outside the App, also stops lending its locale to the App at the gate. The first is inside row 1's wording ("another package of the App"); the second is off-door data outside it. For metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903.

② Semver level

• @objectstack/objectql: minor with !, Clause-②: yes (narrowing), Metadata-protocol: narrowed: right, and the lines now match the code: two refusals, no admission, the withheld reads of rows 10 and 11. The widening sentence and the bullet's mirror clause are removed. The bundle-members bullet is correctly re-scoped to the bare read; the gate has its own bullet.
• The spec changeset is untouched and still right (patch, no key, no export). adr-0087: registered pair-row-locale-addition-refused still names the one entry, which now covers both refusals with one remedy; a second id is not owed.

③ Boundary flags

• The gate and the read now differ by design: the read serves the row at X's address while the gate does not count its locale for X. The gate is the stricter side, the changeset says so and routes the admission to metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899. Accepted under ruling B.
• Routed items (metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899, metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900, metadata-protocol: the item door judges a package member by member, so the package's own member order decides admission #32901, metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903) are outside this diff; nothing here depends on them.
• The incoming-manifest lookup of the previous head is removed with its field; no state is left behind and settledPairRowBinding reads the installed manifests alone again.

④ Design judgment

packages/objectql/src/registry.ts:

• Red line 1 (no read loosened): holds. atGate defaults to false and one caller passes true, registeredBundleHolding, which only the doors and the seal reach. packageScopedHoldersOf, getPackageScopedItem, getEnvironmentScopedItem and the bare read's addition rule keep overlaySlotBinding; their lines are untouched in the delta.
• The gate only narrows against main. For a pair row the gate counts it where the per-package reading (the reading of main) and the binding agree, so a holder's gate members are a subset of its members on main; the arrival copy removes a package-less row from a sole holder and adds nothing. isBundleAdditionPair asks for no member in common, so fewer members can only make more additions. Tried for an admission main refused (a stored row stamped with the arriving package, a legacy per-package pair, ruling A beside an arrival, the reverse order): none found.
• Red line 2 (no guess): holds. gateSlotBinding answers a package or no package from two readings it compares; it picks between no candidates.
• The 18 pins replace the 3 WIDENING pins and assert the answers of main at each gate; the UNCHANGED pins now hang on the gate read, consistent with the reported 13 red when it is removed.

18.pair-row-locale-addition-refused.ts: holds. Both remedies are available for both cases: a shared locale declared in the manifest, or registered first at the item door, makes the package no addition (another namespace, so the names do not meet); a rename always works. Once the package holds the name beside X the package-less row serves neither address; that is the state main already reaches and belongs to the routed follow-ups.

No must-fix, no should-fix.

Implemented-by: claude/project-thread-iv3vz6
Reviewed-by: session_01L6bhgVaKJ9TPfXPRhdqx3e

VERDICT: PASS

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line delta read · 2026-11-13T01:30Z

Head-sha: acc6802279cf88f7424df53e974e0fd3a83de5eb

Verdict: HOLD (text only). No code must-fix. Two clauses are missing from the PR's text (H1 and H2 below); the epic seat ruled both into this PR, and a text re-read turns this to PASS.

PR #32815 (card #32408, replaces #32557). Delta read of the hop c3cc324..acc6802 (5 commits, no merge commit, 4 files, +171/−90) against the previous red-line read 6838271054 (NO PASS, three must-fixes), epic ruling 6838245909 and the seat's choice of option B (6838268615). Contract review 6840278165 (PASS at this head) was read whole. Merge base 2f80f28, unchanged. Every cell below is measured in a worktree at the head unless it says "read". The side-by-side cells come from one run that loads the registry at the merge base (BASE), at the previous head c3cc324 (PREV) and at the head as separate modules and drives each through the same 1288 builds.

All three must-fixes are closed. The epic seat ruled on what this read raised (see "Epic seat's rulings"): it corrects one premise of ruling 6838245909, and it holds the PR for two clauses of text.

The three must-fixes

1. Must-fix 1 (the undeclared narrowing at the package-less row): closed. The three things the ruling asked for are present and match the measurement.
   • FROM → TO row: body row 13, the changeset's Clause-② line ("Second"), its package-less-row bullet and its BREAKING paragraph. Measured for both stamps (none, sys_metadata), W of the App and W its own App: BASE admits W at the item door and the package door, after which the registry's item at X is none and a re-seal reports W against X; the head refuses 422 NAMESPACE_CONFLICT naming X at both doors, X keeps the row, and the cold boot's seal reports W against X on BASE and at the head alike. The move was already at PREV (it was the undeclared one); this hop declares it.
   • A pin per door: NARROWING (delta review N1), item door and …, package door. Each goes red when its own door's arrival count is removed (1 red each), both when both are removed (2 red). The third, …, cold boot, is a CONTROL by nature (the seal reported on BASE too).
   • ADR-0087 entry: the same id (pair-row-locale-addition-refused); its surface, replacement, reason and acceptance criteria name the package-less row (read). The registration gate exits 0. The entry's first remedy was measured: a package that also ships a locale X ships is admitted at the package door, and at the item door when the shared locale registers first; with the L-only member first the item door refuses it, and a retry after the shared locale is admitted, as the entry says. The rename remedy and the first-party count (0) were read, not measured.
2. Must-fix 2 (row 12 too narrow): moot. Row 12 is withdrawn in the code, the body, the changeset and the pins.
3. Must-fix 3 (reverse order, the doors and the seal split): closed under B. With W holding L first and X arriving, the doors refuse X naming W and the cold boot's seal reports X against W, as on BASE (PREV: the seal reported nothing).

Red line 1: resolution is never loosened

• Row 12 is really withdrawn. For row 12's three shapes and the neighbouring shape (an undeclared row, W of the App), in 6 registration orders, through 3 paths (cold boot, item door, package door), with X's manifest installed upfront or at its step: 384 of 384 gate cells (door, seal before the arrival, seal after) are equal at the head and on BASE, over 144 builds. X first: both doors refuse W 422 naming X and the cold seal reports W against X. W first: both doors refuse X naming W and the cold seal reports X against W. A package that reaches two Apps (contract review N2's shape) is refused as on BASE too (PREV admitted it).
• The gate as a whole, 3432 gate cells: 132 differ from PREV, and 130 of those equal BASE; the other 2 are refusals at all three whose candidate list differs. 288 differ from BASE, all in the package-less row's shapes (row 13) and in row 1's family. Over 856 door builds, 0 door cells refuse less at the head than on BASE; 112 refuse more (67 at the package-less row, 45 in row 1's family), and all 112 were already so at PREV.
• The gate's new reading loosens no read. Its only caller is the gate's holding read (both doors and the seal; read). Where the door answers as PREV did (1236 builds), 0 of 127,532 read cells differ from PREV; in the 432 cold builds (the same registered state by construction) 0 of 45,452. The cells are the registry's holders, per-package item and environment item, the resolver for each caller, the protocol's by-name read bare and at each exact address, its attribution, the lists, and the layered read. Against BASE the cold builds differ in 7,422 read cells at the head, and PREV differs from BASE in the same 7,422, cell for cell: rows 2 to 11, read at PREV. In the 50 builds where this hop turns PREV's admission back into a refusal, the registered state is main's again.
• The package door no longer lends its incoming manifest to a pair row. Against the hop's own intermediate commit 3b168f1 (before that removal), 0 of 138,864 cells differ.
• The separate metadata service package was not probed (nor by the previous read); by reading, the gate's reading is not reachable from it.

Red line 2: ambiguity is reported, never guessed

• At the registry nothing in the hop answers by order: the gate's reading returns a holder or none, and the reads are unchanged.
• The four by-name cells of the previous read (item 2 of its "For the epic seat"), measured at the head in both registration orders:
  • Through the gate in row 12's shapes (an arrival shipping only L) none of the four can be reached any more. X first: the arrivals are refused, X's exact address serves the row attributed to X, W's and V's addresses refuse 409 naming X, a disable changes nothing, and the two arrival orders give the same cells. W and V first: X is refused naming them, and X's address and the bare read refuse 409 naming the holders in both orders.
  • They can still be reached three other ways, and there every exact-address cell answers at the head exactly as on BASE and PREV:
    1. A cold boot over the stored state. The seal now reports each arrival against X again (PREV reported nothing). X's exact address serves the row attributed to the arrival registered first; with one of two arrivals disabled, X's address is withheld or serves the row by registration order.
    2. Both doors, with a row of a legacy per-package pair of X. The doors admit both arrivals on BASE, PREV and the head, the seal is silent, and X's address is attributed and, with one arrival disabled, answered by registration order.
    3. Both doors, with an arrival that ships L and also a locale X ships (the semantic entry's first remedy). It is admitted on BASE, PREV and the head, and the seal is silent. X's exact address serves the row attributed to W; with W of the App, W's address and list serve the row declared for X in place of W's own member; with W disabled, X's address is withheld; with two such arrivals and one disabled, X's address is withheld or served by registration order.
  • A row saved after both packages hold is not judged by the gate at all (read; the protocol's save door was not probed).
• So the hop does what option B asks (the gate no longer admits the state and the seal reports it), and the state itself remains reachable through the doors as it was on main. Epic seat's rulings, item 1.

Red line 3: independently releasable

• "Counted for no one at the gate" is row 1's narrowing, declared. Where the binding moves a pair row away from the App, the gate now counts it for no holder: the App loses that locale and X does not gain it. Measured in row 1's family (the App ships en-US, its pair stores a row of fr-FR, a package Z of another namespace that reaches the App ships only fr-FR): with the row declaring X, or declaring a package of the App that holds no item, BASE admits Z and the head refuses it naming the App, at the item door and the package door. That is row 1's FROM → TO in the body, and the changeset's first refusal and gate bullet. With the row undeclared or declaring the App, nothing moves; nor when Z is of the App's namespace or does not reach the App. Consequences of the same loss, all refusals or reports and all already at PREV: X itself arriving after the row is refused naming the App (contract review F4, an accepted deviation), and a cold boot reports X, and Z, against the App. Removing the gate's "no holder" in favour of main's per-package reading turns exactly one test red, the row 1 pin, so the App's loss and row 1 are the same move. Nothing is admitted that BASE refused.
• Clause-②: yes (narrowing), the same token in the body and the changeset: valid. Rows 1 and 13 narrow, rows 10 and 11 withhold, and row 3 still lifts a 409. That 409 was never released (not in the released objectql tag checked; its source changesets are pending), so no (narrowing) would be valid as well. No disagreement with the seat's choice.
• Metadata-protocol: narrowed in both, unchanged: a registration a package author could ship is now refused, as epic seat 1 ruled.
• ADR-0087: the changeset carries the registered marker for pair-row-locale-addition-refused; node scripts/check-adr-0087-registration.mjs --base origin/main exits 0 ("registered … (new here)"), and the same against the merge base. The title carries ! and the changeset's BREAKING paragraph names both registrations.
• Pins: 21 in this hop (18 replacing the 3 widening pins, 3 for N1). Without the gate's reading 13 tests go red: 12 of the 18, and the package-door UNCHANGED pin. Without the arrival count 2 go red, the N1 pins at the two doors. Seven of the 21 are CONTROLs by nature and stay green under every ablation of the hop: the six REVERSE ORDER pins at the two doors (the doors refused X on BASE and at PREV alike, as the body says) and the cold-boot N1 pin.

Counts

• Touched test files at the head: 306 passed, 0 failed (resolver harness 120, exact-qualifier harness 186).
• The nine objectql files that exercise the bare-name gate and the scoped reads: 736 passed, 0 failed.
• Spec migrations: 5 files, 198 passed, 0 failed.
• Probe: 1288 builds on 5 copies of the registry (head, a second copy of the head as a control, PREV, BASE, the intermediate commit), 138,864 cells per copy, 0 thrown. Head against its own copy: 0 cells differ. The rebuilt probe reproduces the previous reader's saved outputs on PREV and on BASE: 4,270 cells over 86 matching builds, all equal.
• CI at the head (read from the API): 71 check runs, 58 success, 13 skipped, none failing or pending. The PR is a draft.

Ablations

Each was applied with scripts/ablation-replace.mjs, proved to land, and restored to the head blob with a clean git status after it. No ablated build was made and nothing ablated went through turbo. The three claimed counts (13, 2, 22 of 306) reproduce exactly.

Ablation	Red / green
A1: the gate's own reading removed (the gate reads the binding, as PREV did)	13 / 293: the nine ROW 12 WITHDRAWN pins, the three cold-boot REVERSE ORDER pins, the package-door UNCHANGED pin
A2: both doors' arrival count removed	2 / 304: the item-door and package-door N1 pins
A3: the binding put back to the per-package reading	22 / 284: 4 in the exact-qualifier harness, 18 in the resolver harness
A4: the gate keeps main's per-package reading	1 / 305: the row 1 NARROWING pin
A5: the item door's arrival count only	1 / 305: the item-door N1 pin
A6: the package door's arrival count only	1 / 305: the package-door N1 pin
A1 over the nine gate files	13 / 723
A2 over the nine gate files	2 / 734
A4 over the nine gate files	1 / 735

CONTROLs stay green in every row.

Must-fix

None in code.

Hold (text only), fixed in this PR

A changeset cannot be corrected once it ships in a release, so both go in this PR, as on #32889 and #32877.

• H1: row 13's mirrored direction. Row 13 names one direction ("a package whose dependencies reach X"). The same refusal is measured in the mirrored direction, where X's dependencies reach the arriving package: BASE admits it and the head refuses it naming X, for both stamps at both doors (4 builds). Add one clause for it in the body's row 13, in the changeset's second refusal and in the entry's surface. The refusal, the remedy and the entry are the same; no code.
• H2: row 3 with the arrival disabled. In the door-reachable state of ruling item 1 below (the App's pair stores a row of L declared for X; an arrival W of the App ships L and also a locale X ships), with W disabled the bare read of L moves FROM 409 TO withheld, where row 3's TO says the row. It is not a loosening. Add half a sentence for it to row 3 in the body and to the changeset's matching bullet (SchemaRegistry#packageScopedHoldersOf).

Nits (for #32903)

1. Row 1 is pinned at the item door only. The package door and the seal's report were measured by the probe; no pin holds them.
2. A pair row that declares a package outside the App moves as row 1 does (measured at both doors), outside row 1's wording "another package of the App". Contract review 6840278165 names it; it is not on metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903's list yet. By reading only, the same holds for a row of a legacy per-package pair that declares a package other than its base.
3. The spec changeset still says "the one registration", and the entry file's header comment "a narrowing of one registration"; the entry now names two.
4. The title and the changeset's headline say every reader binds a pair row by the exact read's owner rule; under option B the gate reads it its own way (the body and the gate bullet say so).
5. Row 13's FROM says X's address no longer served the row. That is the registry's item at X. The protocol's exact read at X still served it on BASE, attributed to the arriving package.
6. The six REVERSE ORDER pins at the doors are controls; their titles read as pins of the fix.

Epic seat's rulings

1. Epic seat corrects the premise of 6838245909. Its items 1 and 4 said the by-order state could not be reached through the doors before and is not reachable through them under B. Measured: on BASE and at the head alike, both doors admit it two ways, with a row of a legacy per-package pair of X and with an arrival that also ships a locale X ships, and the seal is silent in both. There the four by-name cells answer as the previous read recorded them, the by-order cell included. This PR makes no exact-address cell worse (head equals BASE on each), so this does not hold the PR. The by-order answer at an exact address is a silent pick already on main; by the downgrade rule of 6840318180 (present before the release, not made worse by it, no security or wrong-grant reach) it is p2, of the same kind as metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900. The read fix does not depend on the admission, so 席 A files it as its own p2 card under metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408 (queued, not dispatched) and notes on metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899 that the read fix is on that card and no longer the gate of the admission.
2. Ruling item 4 stands. The bare read in that door-reachable state moved from BASE at PREV, not in this hop (head equals PREV). With both holders served it still refuses 409, now naming the two real holders without the pair. With W disabled it is H2. With X disabled it is the cell item 4 placed in the metadata-protocol: the bare read still serves an App-pair row of an email_template member whose only holder is disabled #32814 family: not a disclosure, no caller's admission involved, and inside row 3's declared and accepted widening. That the disabled X's customization row is answered as W's belongs to metadata-protocol: the bare read still serves an App-pair row of an email_template member whose only holder is disabled #32814's family (p2). The detail of that cell went to the seat directly.
3. Row 13's mirrored direction is fixed here (H1), not on the card.
4. Clause-②: no change. no (narrowing) would be valid too, since the lifted 409 was never released; the PR keeps yes (narrowing).
5. metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900 is p2, per the downgrade 6840318180; the p1 in its body predates it.

Older than this PR, for the seat to route

• In the reverse-order state the doors leave (W of the App holds, X refused), W's exact address serves the row declared for X, which holds nothing, on BASE and at the head alike; the registry binds that row to no package. It may be one of the residual shapes metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 carries (not checked).

Measured and read

• Measured: every count; every ablation; rows 1, 12 and 13 at both doors and the seal on BASE, PREV and the head; the order and path matrix; the read cells on the three registries; the four by-name cells in both orders with disables; the entry's first remedy; the ADR-0087 gate.
• Read only: the entry's text, the first-party counts, the rename remedy, CI check runs, the cards metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899, metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900, metadata-protocol: the item door judges a package member by member, so the package's own member order decides admission #32901, metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903 and metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561, the FROM values of rows 4 and 7 to 11.
• Not run: the full objectql suite, the dogfood battery, the generated-artifact check, the metadata service package, the protocol's save door.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Contract-review-handoff: triage#1 · head 463a175 · delta acc6802..463a175, text only (changeset, ADR-0087 entry surface, PR body r5) answering the epic red-line HOLD 6841098779 (H1, H2); the previous delta PASS is 6840278165 at acc6802

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head 463a175 · 2026-11-13T01:37Z

Taken on the request: a delta review of acc680227..463a1752b (text only), after the delta PASS 6840278165 and the epic red-line HOLD 6841098779, at CONTRACT_REVIEW_TIER. Triage reviews contract PRs on the 18.4.0 release line for the release window, per the maintainer (triage#1 session): 「可以契约复审」 · 「发版期间例外」.

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line text re-read · 2026-11-13T01:39Z

Head-sha: 463a1752bdc89d86f7053c89db469eebb4731837
Verdict: PASS. H1 and H2 of 6841098779 are closed in the text. The epic seat ruled both into this PR, because a changeset cannot be corrected once it ships in a release.

Read: the one commit since acc6802, with no merge of main. It changes the main changeset (4 lines) and one string of the semantic entry's surface, and touches no source or test file. Also read: the body's revision r5 on the PR.

• H1, row 13's mirrored direction, is now named in all three places.
  • The changeset names it in the Clause-② line's second refusal and in the package-less row's bullet ("or that X's dependencies reach"), and in the BREAKING paragraph ("or that X depends on").
  • The entry's surface uses the changeset's words.
  • The body names it in row 13, in the Clause-② line and in the note above the table.
  • This matches what 6841098779 measured: main admits the arrival, and the head refuses it naming X, for both stamps at both doors.
• H2, the disabled arrival, is now in row 3. Both the body's row 3 and the changeset's SchemaRegistry#packageScopedHoldersOf bullet carry it. The row of L is declared for X, and a package W of the App holds the name through L and a locale X also ships. With W disabled, the bare read of L moves FROM 409 TO withheld. This is the cell 6841098779 measured.
• Unchanged:
  • Clause-②: yes (narrowing) and Metadata-protocol: narrowed, the same in the body and the changeset (read with the repo's reader).
  • Every pin and count of 6841098779. The code is byte-identical to acc6802.
• Gates at this head:
  • The ADR-0087 registration gate and the three changeset gates each exit 0.
  • The spec migration tests pass, 198 of 198 in 5 files (the entry file changed).
  • CI on this head was still running at read time: none failed so far (read).

The six nits of 6841098779 stay on #32903, as ruled.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 463a1752bdc89d86f7053c89db469eebb4731837
Local-runs: none
Scope: packages/spec/src/migrations/entries/semantic/18.pair-row-locale-addition-refused.ts + .changeset/32408-pair-row-binding-every-reader.md

Delta round on record 6840278165 (PASS at acc680227), after the epic red-line HOLD 6841098779 (text only: H1, H2). Reviewed: the hop acc680227..463a1752b and PR body r5. Read outside the hop, never reviewed: isBundleAdditionPair, bareNameHoldersMeet (bare-name-one-holder.ts), bareNameHoldersOtherThan, registeredBundleHolding, bareNameBundleAdditionMeets, withArrivingMembers, refuseBareNameConflicts, packageScopedHoldersOf (registry.ts), readMetaItemFace, servedHolderAddressOf (protocol-meta-item-face.ts), packageDependencyClosure. Every trace is a static read at the head; nothing was built or run. Measured cells quoted below are the red-line read's, relayed.

Is the hop text only: yes. The compare is ahead 1, behind 0, one commit (463a1752b), no rebase, no merge of main. Two files, 7 lines each way:

• .changeset/32408-pair-row-binding-every-reader.md (+4/−4), four hunks of prose: the Clause-② line's second refusal gains "(or that X's dependencies reach)"; the BREAKING paragraph gains "(or that X depends on)"; the packageScopedHoldersOf bullet gains the W-disabled exception (FROM 409 TO withheld, no loosening); the package-less-row bullet gains "(or that X's dependencies reach)". The front matter, the Clause-② token, Metadata-protocol: narrowed and the adr-0087 marker are untouched.
• 18.pair-row-locale-addition-refused.ts (+3/−3), one hunk inside the surface string literal: the same parenthetical, with the line breaks re-flowed. id, replacement, reason, acceptanceCriteria and the header comment are byte-identical.

No file under packages/objectql, no test, no generated artifact. The entry id appears in three files of the tree (the entry and the two changesets), so no derived copy of the surface went stale.

Check-runs on this head at review time: 68 runs; 24 success, 13 skipped, 31 in progress, none failed. No red check-run. This verdict is the contract's and does not cover the runs not concluded.

The HOLD, point by point

• H1 (row 13's mirrored direction): answered in all three places asked. Body row 13 and the body's Clause-② line; the changeset's Clause-② line, BREAKING paragraph and package-less-row bullet; the entry's surface.
• H2 (row 3 with the arrival disabled): answered in both places asked. Body row 3's TO cell and the changeset's SchemaRegistry#packageScopedHoldersOf bullet, each with the state (the row of L declared for X; W of the App holding the name through L and a locale X ships too; W disabled), the cell (the bare read of L), FROM 409 TO withheld, and "no loosening".
• The HOLD's six nits were routed to metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903 by the HOLD itself and are not owed here; the hop leaves them as they were.

① Derived judgments

• H1 matches the code. isBundleAdditionPair is symmetric: adds(a, b) || adds(b, a), each arm asking that the adder reaches the other, is not reached back, and shares no member. With the arrival counted (withArrivingMembers), X and the arriving package are two composite holders, the package-less row binds to neither, X holds only what it ships and the arrival holds only L. When X's dependencies reach the arrival, the second arm is true, bareNameBundleAdditionMeets returns true whatever the namespaces, and bareNameHoldersOtherThan returns X: the arrival is refused naming X. On main the row was X's member, the two shared L, neither arm held, and the namespaces did not meet: admitted. That is the FROM and the TO the text states, and it agrees with the red-line read's four measured builds (both stamps, both doors).
• The remedy holds in the mirrored direction too. A locale shared with X gives a member in common, so neither arm holds; a rename leaves the name. The replacement needed no change.
• H2 matches the code as far as the diff's package goes. At the head the pair is no holder, so the every-holder set is X and W; with W disabled packageScopedHoldersOf serves X alone. servedHolderAddressOf then reads the bare request at X's address, and readMetaItemFace withholds an answer whose item is stamped with a disabled package. That the row of L is stamped with W there (W being the package that ships L) is the red-line read's measurement, not traced here to its end; the protocol's read is outside this PR. On main the pair counted as a second served holder beside X, so the bare read refused 409 naming X and the pair. A 409 becoming a withheld item serves nothing new: "no loosening" is right.
• Nit 1. For the mirrored direction the changeset still says the package is refused "as an addition to X's template". By isBundleAdditionPair it is X's holding that adds to the arriving package's bundle there. The refusal, the holder it names and the remedy are as stated; only the gloss is one-directional. The entry's surface carries no such gloss and is exact.
• Nit 2. The changeset's row-3 bullet says "a name one package of the App holds" where body row 3 says "one served package"; the exception's W also holds the name. The two agree only through the changeset's own disabled-holder bullet (a disabled package holds no name).

② Semver level

• Unchanged and right: @objectstack/objectql: minor with !, Clause-②: yes (narrowing) (the same token in the body and the changeset), Metadata-protocol: narrowed. H1 widens the wording of the second refusal to a shape the code already refused at acc680227; it is not a third refusal and moves no level. H2 is a refusal becoming a withheld read and moves none either.
• The spec changeset is untouched (patch, Clause-②: no, Metadata-protocol: none); the entry gains no key and no export, so patch still holds. One id, one remedy, both directions: no second ADR-0087 id is owed.

③ Boundary flags

• "First-party packages in that position: 0" and "Nothing in the workspace is in either position" are unchanged text that now also stands for the mirrored direction. Not re-derived here beyond a path grep at the head (one first-party manifest, examples/app-showcase, declares email templates, so no two first-party packages can share a template name). The red-line read also has the count as read, not measured.
• A dependency cycle (each of X and the arrival reaching the other) makes neither arm of the pair true, so such a package is admitted. The text does not say so in either direction; the same gap was in the wording before this hop.
• Carried, not caused here: the spec changeset still says "the one registration" and the entry's header comment "a narrowing of one registration" (HOLD nit 3, routed to metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903). A changeset cannot be corrected once released, so that card has to land before the release is cut.

④ Design judgment

packages/spec/src/migrations/entries/semantic/18.pair-row-locale-addition-refused.ts: holds. The surface now names both directions of the dependency between X and the arriving package, which is the shape the gate's symmetric pair test refuses on the head (① H1). Against ruling 6841098779 H1 ("one clause … in the entry's surface; the refusal, the remedy and the entry are the same"): done as ruled, id kept. Against its first consumer, the changeset's adr-0087: registered marker: the id still matches. Nit 3: the reason explains the second narrowing through "a package on X" alone; it is true for that direction and silent on the mirror, which the surface and the direction-neutral acceptanceCriteria cover.

.changeset/32408-pair-row-binding-every-reader.md (the implementing text in the hop): agrees with the code in each of the four changed places (①), subject to nits 1 and 2.

No implementing code is in the hop, so the design judgment of registry.ts in record 6840278165 stands unchanged for this head.

No must-fix, no should-fix. Three nits (1, 2, 3), none affecting the refusal, the named holder or the remedy; for #32903.

Implemented-by: claude/project-thread-iv3vz6
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line text confirmation · 2026-11-13T01:42Z

Head-sha: 6885c59a1e4811fa3e2ed0978959d007fdc4961e
PASS of 6841259753 stands at this head. The one commit since 463a175 changes one line, the spec changeset's headline. It now names both registrations the entry lists: row 1, and row 13 with its mirrored direction. The epic seat ruled this into the PR. No other file moved. Its body's singular "the narrowing" is right as it stands: the main changeset declares one narrowing with two refusals.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Regen-provenance: 6841286688 · 463a1752bdc89d86f7053c89db469eebb4731837 → 6885c59a1e4811fa3e2ed0978959d007fdc4961e · git diff --name-only → .changeset/32408-pair-row-locale-semantic-entry.md

The hop rewrites one changeset headline only (the epic seat's text ask after re-read 6841259753: the headline names both narrowings the entry registers). No code, test or entry file moved; the contract review PASS 6841286688 at 463a1752b carries to this head.

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Regen-provenance: 6841286688 · 6885c59a1e4811fa3e2ed0978959d007fdc4961e → 3b386d74141b5f3b2e85c0123403c3a157925aaa · diff <(git diff 2f80f2897 6885c59a1 -- . ':!.changeset' | grep -vE '^(index |@@ )') <(git diff 20f8621d1 3b386d741 -- . ':!.changeset' | grep -vE '^(index |@@ )') → (empty)

The hop is a main merge only (landing K = 17 from PRBASE 25ee50765, so landing-operations asks for a main merge before the queue; relay pr_update_branch, no conflict). The PR's own delta against its base is the same six files with the same hunk bodies; only blob ids and hunk line offsets move, because #32741, #32742 and #32808 landed on main in packages/objectql/src/registry.ts and the two resolver test files above this PR's hunks. The contract review PASS 6841286688 at 463a1752b (carried to 6885c59a1 by 6841306275) carries to this head; the re-run of every check on 3b386d741 is the reading for the landed siblings, and ACCEPT waits for it.

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

维护者速读

• 改了什么：App 配对里存的一条本地化行（email 模板等）归属哪个包，注册表现在只有一个答案，所有读者（精确读、列表、门禁封存）都按它读。两处原先被放行的注册现在会被拒并点名（正文第 1、13 行），首方包 0 处受影响；配套一条 ADR-0087 语义条目告诉升级者怎么改。
• 为什么改：卡 metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408，同一条行在不同读者处被算成不同包的成员，造成封存报错与读到的内容不一致。
• 风险与回滚：收紧注册（Clause-② yes (narrowing)）；回滚即 revert 本 PR。
• 先看：packages/objectql/src/registry.ts（gateSlotBinding 与配对行绑定）。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/package-scoped-resolver.test.ts src/package-scoped-exact-qualifier.test.ts，预期全部通过。
• 需要你做的：无，席位落地。

席位核对

• Head: 3b386d74141b5f3b2e85c0123403c3a157925aaa; mergeable_state clean. It is 6885c59a1 plus a relay merge of main (landing K was 17 from PRBASE 25ee50765); Regen-provenance 6841847606 records the PR's own delta as the same six files and hunk bodies across the merge.
• Shape: 6 files, +763 / −26, under 3000 lines, no Tier H path. Fixes #32408; Clause-②: yes (narrowing), Metadata-protocol: narrowed, ADR-0087 entry pair-row-locale-addition-refused registered.
• Gates: check-runs on this head, 56 success, 11 skipped, none failing or pending (the re-run after the main merge, which is the reading for fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741, feat(core, objectql, metadata, metadata-protocol, plugin-security): a permission-set name is held once per namespace, judged by one predicate (ADR-0150 child B) #32742 and fix(metadata-protocol)!: a pair address reads the package it names: its envelope is that package's, and an App pair two of whose modules hold the name is refused naming both (ADR-0150 D5) #32808 landing in the same files).
• Contract review: triage#1 PASS 6841286688 at 463a1752b, carried by Regen-provenance 6841306275 (changeset headline only) and 6841847606 (main merge). Earlier: FAIL 6835646675, delta FAIL 6837360468, delta PASS 6840278165, each closed on the next head.
• Epic red line: re-read NO PASS 6838271054 → epic ruling 6838245909, seat chose option B (row 12 withdrawn, 6838268615); delta re-read HOLD 6841098779 (text only, H1 H2 fixed at 463a1752b); text re-read PASS 6841259753 and final text confirm 6841299137.
• Accepted deviations: none outside the records above. Follow-ups already filed under metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408: metadata-protocol: admit a package beside the one owner of an App pair row only once the by-name read follows the registry binding (withdrawn row 12 of #32408) #32899 (row 12 admission after a by-name read), metadata-protocol: the registry's bare slot keeps only the row hydrated last when a pair row and a package-less row of the same member are both stored #32900 (bare slot keeps the last hydrated row, p1), metadata-protocol: the item door judges a package member by member, so the package's own member order decides admission #32901 (item door member order), metadata-protocol: nits from the epic red-line read of PR #32815 (semantic entry remedy order, unpinned owner rule, seal direction) #32903 (nits), metadata-protocol: the by-name read answers an exact address by registration order when two packages ship a locale of an App pair row declared for one of them #32981 (read fix). No extra round.
• Landing: epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 card, on the release line.

ACCEPT