[objectstack-fleet]

Requested by Sales · project thread
Fixes #32751

Clause-②: yes (widening)
Metadata-protocol: none

维护者速读

• 改了什么：两个包在别的对象上持有同名 action、而环境自己在第三个对象（如 lead）上写了同名的无包 action 时，裸路由 /actions/lead/NAME 现在直接读环境自有项（registry 里的无包项 + 环境存储里的无包行）并把它作为该路由的声明服务出来，不再答「无声明」。本 PR 只保证声明被服务；启动后的宿主上脚本体 action 是否被绑定并执行，由 objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990 单独处理；不经过任何持有者的精确地址，也不当作持有者的条目。
• 为什么改：metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568（PR fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741）关掉了「借第一个持有者的精确地址拿到无包副本」这条路，于是这类环境 action 今天在该路由上连声明都拿不到（本卡 p1，发版线）。
• 风险与回滚：只改执行面路由在「裸读被拒且没有候选持有者拥有这条路由」这一个分支的答案；有包（含已停用的包）绑定该对象、或该无包项在环境存储里没有行（宿主/插件代码）时仍答「无声明」；存储读失败答 503。不改存储与 schema，第一方计数为 0。回滚即 revert 本 PR。
• 先看：packages/runtime/src/action-execution.ts（environmentOwnerOfUnheldRoute，以及 routeOwnerOfRefusedRead 末尾 rung.length === 0 一行）。
• 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run src/action-package-addressing.test.ts -t "#32751"，预期 8 条全部通过。
• 需要你做的：无，席位落地。

What changes

Two packages hold an action of one name, A on account and B on contact, and the environment authors its own package-less action of that name on lead. The protocol's bare execution read refuses the name (two package holders), so the bare route recovers through routeOwnerOfRefusedRead, which reads each package candidate at its own exact address and keeps the one that owns the route. Before #32568 the first holder's address served the environment's package-less copy, so lead found the environment's declaration through A's address. #32568 closed that (a sealed type's package-less copy is declined at a holder's exact address, epic ruling 6817768147), and lead answered no declaration.

• routeOwnerOfRefusedRead: when no candidate owns the route and every candidate's own address answered, the route asks environmentOwnerOfUnheldRoute instead of answering no declaration. A candidate whose address could not be read still leaves the bare read's refusal standing, as before.
• environmentOwnerOfUnheldRoute (new, module-private): the registry's package-less item of the name that owns the route (bound to the routed object first, object-less after), served only when the environment's store holds its row bound to no package (environmentStoredActionNames, the same origin test the bare holder rule applies through packagelessOriginOf). It carries no package, so the dispatch is unqualified, as the bare call's always was. It never reads a holder's exact address (epic red line 2).
• It never answers when any package's action of the name owns the route, a disabled package included: an enabled one's own declaration answers there as before, and a disabled one keeps the route no declaration, which is main's answer there and stays so. The registry's listing with includeDisabledPackages is the read that sees one; the protocol's reads withhold it. It also answers no declaration for a package-less item with no row in the store (the platform's: host or plugin code), on an engine with no store (no find, or no sys_metadata object), and on a registry that cannot list every holder.
• A store read that fails for any other reason answers degraded (503), never no declaration (ADR-0110 D3).

The protocol's reads cannot answer this route: the execution face's bare read refuses the name, and the merged listing (getMetaItems) folds the package-less item into the holders' slots as their stand-in (ADR-0048), so the environment's item is not in it. No change to packages/metadata-protocol or packages/objectql.

FROM → TO

#	Route (A's approve on account, B's on contact, the environment's own on lead with its package-less row stored)	FROM (main a7c97297)	TO	Clause-② arm
1	/actions/lead/approve, environment registered last	no declaration	the environment's action declaration, no package	widening
2	/actions/lead/approve, environment registered first	no declaration	the same	widening
3	/actions/lead/approve, the environment's item object-less, both orders	no declaration	the environment's action declaration, no package (an item bound to lead comes before an object-less one)	widening

This PR serves the declaration. With the declaration served, the dispatch is unqualified and runs whatever handler the engine has bound for lead (the pin registers one and sees it run). A booted host does not yet bind a script-bodied environment action whose name a package also ships, so that body answers 404 at dispatch: measured on this head with a cold boot, and tracked in #32990, not here. Flow, update-record and API actions do not go through that binding.

Unchanged, pinned as CONTROLs: /actions/account/approve answers A's and /actions/contact/approve B's, in both orders. A disabled package's action bound to lead keeps lead no declaration, in both orders, as on main. The platform's item on lead, with no row behind it, stays no declaration. An engine with no metadata store keeps case 2's existing pin (no declaration, not degraded). An enabled third package bound to lead keeps lead on that package's own declaration, in both orders. A candidate whose own address answers not-held-by-qualifier keeps the bare read's refusal; neither ever yields the environment's item.

Acceptance notes

• Premise re-measured on main a7c97297 (after fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 a888c5c9e) before any edit, with a probe that was then deleted. lead answered no declaration in both registration orders. The execution face's bare read refused naming A and B only, and each holder's exact address served that holder's own item.
• Measured, not in this PR, reported to the seat: the environment's own address /actions/_env/lead/approve (resolveAddressedRouteActionDeclaration with the environment qualifier) answers 404 in this state, and also beside ONE package holder. It reads the merged listing, which does not list the package-less item of a name a package holds. This PR does not route through it.
• Measured, not in this PR, reported to the seat: with A disabled and B enabled beside the environment's item, the execution face's bare read answers no item. So /actions/contact/approve (B's own route) and /actions/lead/approve both answer no declaration on main, and this PR leaves both unchanged. The read never refuses there, so the recovery this PR extends is not reached.
• First-party count: 0. No first-party composition has two packages holding one action name beside an environment action of that name.

Tests

• packages/runtime/src/action-package-addressing.test.ts: a new [#32751] describe beside case 2, with eight cases. The environment's item on lead is served with no package and its handler runs, both orders. CONTROL: each holder's own route is unchanged, both orders. The environment's object-less item answers lead, both orders. A disabled package binding lead keeps it no declaration, both orders. The platform's item with no row stays no declaration. NEIGHBOUR: an enabled third package bound to lead answers its own declaration, both orders; a not-held-by-qualifier candidate keeps the refusal. A failing store read is degraded. case 2's lead assertion now also asserts no degraded; its comment and the describe's header point at the new describe. The new describe's engine reads the same rows as the protocol's row store double, and like it refuses a where combinator it does not implement.
• Ablations (each through scripts/ablation-replace.mjs, mutation landed and restore verified by blob hash against HEAD; the runtime suite imports ./action-execution.js from source, so no rebuild is involved):
  • the recovery answers no declaration in place of the environment read: 3 failed (the served pin, the object-less pin, the degraded pin);
  • the holder check removed: 1 failed (the disabled-holder pin);
  • the store origin test removed: 1 failed (the platform pin);
  • a failing store read answered as no declaration: 1 failed (the degraded pin);
  • an engine with no store answered as a failing read: 1 failed (case 2).
  • the environment read put before the unique owner, with the holder check removed: 1 failed (the enabled-third-package pin);
  • a candidate that could not be read no longer keeps the refusal: 1 failed (the not-held-by-qualifier pin).

Verification

On head fd531c37 (branch claude/project-thread-svxbge; origin/main merged by merge twice: 25ee5076 before the PR, 04c35f09 before the queue, 23 commits, no conflicts; the card's net diff over the new merge base is still the same 3 files):

Local runs

• pnpm --filter @objectstack/runtime exec vitest run src/action-package-addressing.test.ts: 75 passed (75), on fd531c37 after a full packages/** rebuild; pnpm --filter @objectstack/runtime typecheck: exit 0.
• pnpm --filter @objectstack/runtime test (the whole suite, through scripts/pm/os-verify-lock.sh) on the fix before the merge: Test Files 592 passed (592), Tests 11617 passed, 19 skipped. After the merge, with the closure rebuilt: every runtime test file matching action, Test Files 70 passed (70), Tests 1428 passed (1428).
• pnpm --filter @objectstack/runtime typecheck: exit 0 (check:test-typecheck: OK, the debt ledger held).
• node scripts/pm/dispatch-gates.mjs --ran: 66 derived, 66 run, 0 NOT-MEASURED, 0 UNRUN, every family recorded with its exit code (all 0). 51 families ran on 58d38923. The 15 that read the test file (among them check:where-matcher, check:test-source-alias, check:engine-double-contract, check:type-check-debt) ran again on 68ef9c71 after the store double was made to refuse a combinator it does not implement (check:where-matcher caught it on 58d38923). check:dual-build-cjs-loads and check-plugin-teardown-shape --self-test first answered exit 3: the build was not complete and the clone was shallow. They ran again after a full packages build and git fetch --unshallow, and both exited 0. On c9732c20 (test file and changeset only) the families that read them ran again: 24 families (the 13 test-file readers among them check:where-matcher, check:engine-double-contract, check:type-check-debt, and the 11 changeset and docs readers), all exit 0; dispatch-gates --ran 66 derived, 66 run, 0 NOT-MEASURED. pnpm --filter @objectstack/runtime typecheck: exit 0. After the 04c35f09 merge, on fd531c37 with the packages rebuilt, all 66 derived families ran again: 66 run, 0 NOT-MEASURED, 0 UNRUN, every exit 0.

CI on this head: see the check runs.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic (not touched).
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint runs in CI on the final head.
• 4. One issue, one branch, one pull request.
• 5. A change that publishes carries a changeset (@objectstack/runtime patch), and both declaration lines are filled in here and in the changeset.
• 6. packages/spec not touched.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 29 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d4b14a85048f45e52622eb520a00aaea2fe5bda2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1f4ebbc1aaddc2bc475357478bce84d3eea9bc55 — the merge of head fd531c373a52c68892e75ff7a567022ac0fdd8d7 into base d4b14a85048f45e52622eb520a00aaea2fe5bda2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1f4ebbc1aaddc2bc475357478bce84d3eea9bc55 && git checkout 1f4ebbc1aaddc2bc475357478bce84d3eea9bc55
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d4b14a85048f45e52622eb520a00aaea2fe5bda2 fd531c373a52c68892e75ff7a567022ac0fdd8d7 && git checkout -B drift-repro d4b14a85048f45e52622eb520a00aaea2fe5bda2 && git merge --no-ff fd531c373a52c68892e75ff7a567022ac0fdd8d7

node scripts/docs-audit/affected-docs.mjs --json d4b14a85048f45e52622eb520a00aaea2fe5bda2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Contract-review-handoff: triage#1 — contract reviews go to triage by the maintainer's rule (2026-11-13T02:11Z) · head 68ef9c7

Card #32751 (p1, epic #31527 release line). Declared Clause-②: yes (widening), Metadata-protocol: none, runtime patch. Dev report: #32751 comment 6841728228.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head 68ef9c7 · 2026-11-13T02:13Z

Taken on the request: declaration face (Clause-②: yes (widening); the paths decide no schema or rules face) at TIER_DEFAULT. Triage reviews contract PRs on the 18.4.0 release line for the release window, per the maintainer (triage#1 session): 「可以契约复审」 · 「发版期间例外」.

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 68ef9c717f74b5ae68f18f3a398713e346c6164c
Local-runs: none

Face: declaration. The diff is three paths (.changeset/env-action-bare-route-unheld-object.md, packages/runtime/src/action-execution.ts, packages/runtime/src/action-package-addressing.test.ts): no published schema, no governed path. The PR body and the changeset each carry the line-initial Clause-②: yes (widening) and Metadata-protocol: none, so the review is owed by the Clause-②: yes line alone. Inputs read: card #32751 (body and all five comments, including the p1 re-grade and both claims), PR #32987 (body, file list, net diff at the head), and the head's check-runs. Code outside the diff was read to judge the change, not reviewed.

① Derived judgments

The widening matches the card, and goes no wider. Card Do-1 asks that the bare route resolve the environment's own item when no holder binds the object, without reading it through any holder's exact address. In the tree, routeOwnerOfRefusedRead changes one answer only: the rung.length === 0 arm, when every candidate's own address answered and none owns the route. That arm used to answer { action: undefined, obj } and now calls readEnvironment(). Every other arm is byte-identical: fewer than two candidates, a non-package candidate, a refused candidate address other than not-held-by-qualifier, an unread candidate, two owners on one rung, and a thrown read. environmentOwnerOfUnheldRoute never calls readAt, so it never touches a holder's address. It returns no packageId, so the dispatch is unqualified. Red line 2 holds.

It cannot serve another package's action. The function answers none whenever any packaged item of the name owns the route: _packageId set, and bound to the routed object or object-less. It serves only an item with no package. ownsRoute uses standaloneActionOwnerKey, the same ladder the outer ownsRoute reaches through the alias standaloneActionObjectName.

It cannot serve a disabled package's action, and it honours ruling 6824698376 A. The registry is read with listItems('action', undefined, { includeDisabledPackages: true }). SchemaRegistry.listItems filters disabled packages only when that flag is unset, so a disabled package's item bound to lead (or object-less) still blocks the environment item. That case is pinned in both registration orders.

It cannot serve the platform's item or an item from another source. The served item must also match an active sys_metadata row with no package, keyed OWNER:NAME through environmentStoredActionNames, the origin test the bare holder rule already uses. A package-less item with no row (host or plugin code) answers none, and that case is pinned. An engine with no store answers none: no find, or OBJECT_NOT_FOUND naming sys_metadata through listingNotServed. Case 2's existing pin now also asserts no degraded. Any other store failure answers degraded (503, ADR-0110 D3), and that case is pinned.

It does not bypass the 409 RESOURCE_CONFLICT. bareRouteHolderRefusal (two holders on this route's key) runs first and is unchanged. The new arm is reached only when no package candidate owns the route. Inside it, a packaged owner forces none rather than a pick, and among package-less owners the function serves exactly one per rung (bound before object-less) or none. It never chooses between two holders. admitResolvedAction still answers any refusal with 409 before it reads the declaration.

The permission and record-access checks still run on the new path. The new answer has the same shape as every other declared answer, { action, obj }, and goes into admitResolvedAction like any other. That function does not branch on how a declaration was resolved, so every gate runs in its usual order: ADR-0106 visibility, the AI-door rules, the ADR-0066 D4 capability gate against the environment item's own requiredPermissions, the ADR-0126 activation consult, actionHandlerOwnerRefusal (a handler that another declared action owns is refused), the type check, the ADR-0104 param contract, and the subject-record load under the caller's RLS. refuseDispatchToDisabledObject still runs before resolution.

The tests pin the served case and its neighbours. The new [#32751] describe sits beside case 2, as card Do-2 asks. It pins:

• the newly served case: lead serves the environment item with no package and its handler runs, in both orders;
• the CONTROL: account answers A's item and contact answers B's, in both orders;
• an object-less environment item, in both orders;
• a disabled holder on lead, which stays none;
• the platform item with no row, which stays none;
• a failing store read, which answers degraded.

The PR body reports an ablation per guard, each with a failing pin. That is consistent with the pins in the diff, but this review did not re-run it.

• should-fix — the claim that the action runs is proven only with a hand-bound handler and a hand-registered item. The served pin calls engine.registerAction('lead', 'approve', …) itself, and shipPackageless registers the registry item directly. On a booted kernel, ObjectQLPlugin.resyncAuthoredActionsNow filters out every authored action for which isArtifactShippedAction is true. That predicate asks registry.getArtifactItem('action', name) by NAME alone, so any installed package that ships approve (here A and B) stops the environment's lead:approve row from being bound. executeRegisteredAction has no fallback to the body. A script-bodied environment action on such a route would therefore get past every gate and then return 404 at dispatch ("Action 'approve' on object 'lead' not found"), where today it answers no declaration. That outcome is fail-closed but is not "可执行" as the card's 验证 line asks. Flow, declarative-update and same-origin api actions do not depend on that binding. The code is in packages/objectql/src/plugin.ts, outside this diff and its claimed surface. Before merge: either measure the full path on a booted kernel (stored row, then boot hydration through registerOverlay, then resync, then the route), or file the binding gap as its own card and narrow the PR's FROM → TO wording from "its handler runs" to "its declaration is served".
• nit — the new code reads the registry copy, not a protocol read. A comment in the same function (rest: POST /api/v1/actions/global/NAME runs a disabled package's object-less action (200, the handler's answer) while GET /api/v1/meta/action/NAME and MCP no longer serve it #25308) says the registry copy is not consulted when the protocol has a by-name read. The jsdoc explains why the protocol cannot answer here, and the disabled-package half of that rule is covered by includeDisabledPackages. Even so, the served body is the registry's, so no protocol-side serving rule applies to it. Today the risk is contained: registerOverlay does not register a declined package-less row of a sealed name, and the store check requires an active package-less row. The way out is the dev's out-of-scope finding (a): the _env address answers 404 here. Once that is fixed, this path can ask _env instead of the registry.
• nit — two neighbours are not pinned with the environment item present. One is an enabled third package bound to lead, which keeps its existing answer. The other is a candidate address answering not-held-by-qualifier, where the bare refusal stands. In both cases the code never reaches the new arm, but a pin would show that the new arm does not pre-empt either answer.

② Semver level

@objectstack/runtime patch. AGENTS.md (Post-Task Checklist 3) says a non-protocol change, widening or breaking, ships patch, and Metadata-protocol: none takes patch. The level matches the declarations.

Confirmed: Clause-②: yes (widening) is line-initial in both the PR body and the changeset, with the arm from the closed pair. It is not no (narrowing), so the face stays declaration at TIER_DEFAULT and no ④ is owed. The changeset text matches the tree: FROM no declaration TO the environment's own action with no package, in either order, never at a holder's address; holders' routes unchanged; a package binding the route (a disabled one included) stays no declaration; an item with no row stays no declaration; a failing store read answers 503.

• nit — the changeset leaves out one served shape. Row 3 of the PR's FROM → TO table (the environment's object-less item answers lead) is a widened answer the changeset never names; it speaks only of an action "on a third object (lead)". Add one sentence so the CHANGELOG lists the widening completely.

③ Boundary flags

• Scope: the three paths sit inside the claimed file surface (action-execution.ts, the addressing test, .changeset/**). Nothing changes in packages/metadata-protocol, packages/objectql or packages/spec, and no governed path is touched.
• Red line 2 (never served as, or read through, a holder's exact address) holds. Ruling 6824698376 A (a disabled package is still a holder) holds. Seat ruling B's residual (the execution face beside a package-less item) is left as it was, and the PR body says so.
• CI on the head is not green:
  • PR-body guards (claim · duplicate · Part-of · single-writer path) fails with check:closing-target-claim: the card had no Claim: naming claude/project-thread-svxbge. The restated claim (comment 6841742781) naming that branch was posted after the guard ran. A re-run should clear it, but none has run yet.
  • Test Core (1/8), (2/8), (3/8), (5/8), (6/8) and (7/8) are still in progress.
  • The PR is a draft. Merge waits for a green head.
• Out-of-scope findings from the dev, carried here so they are not lost: (a) /actions/_env/lead/approve answers 404 beside package holders; (b) with A disabled and B enabled beside the environment item, /actions/contact/approve answers no declaration on main. Neither changes with this PR, and neither has a card yet. The handler-binding gap in ① should be filed beside them.
• First-party count 0, as the PR states.

Implemented-by: claude/project-thread-svxbge
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line read · 2026-11-13T02:32Z

Head-sha: 68ef9c717f74b5ae68f18f3a398713e346c6164c

Verdict: HOLD (text only). One must-fix, M1 (red line 3): the TO says the environment's action runs, and on a booted kernel a script action does not. The epic seat ruled the remedy: narrow the text in this PR and carry the binding gap on its own card (see "Epic seat's rulings"). A text re-read turns this to PASS.

PR #32987 (card #32751, p1). First read: the body, the changeset, the card, contract review 6841909747 (PASS, with M1 as its should-fix), and the net diff over the merge base 25ee507 (3 files, +192/−11). The merge of main is clean: git show --remerge-diff of 58d3892 is empty. Cells marked measured were run in a worktree at the head. BASE cells ran the same probe with action-execution.ts at the merge-base blob.

Must-fix

M1: "its handler runs" holds only for a handler bound by hand.

• What the PR claims:
  • Body row 1 TO: "its lead handler runs".
  • Changeset: FROM "the environment's action could not run there" TO the environment's own action.
  • The pin binds lead:approve itself (engine.registerAction).
• What a booted kernel does:
  • The plugin's authored-action resync skips a stored action row when any code package ships an action of that name, on any object (isArtifactShippedAction asks getArtifactItem('action', name) by name).
  • Measured on that resync with a real registry and a package-less lead:approve row:
    • no package holder: bound;
    • one holder on another object: not bound;
    • two holders (this PR's state): not bound.
  • Read: with nothing bound, the dispatch misses every key and the REST door answers 404.
  • So for a script action, the default type and the pin's, the route now serves the declaration and runs its gates, then answers a 404 routing miss.
  • Per contract review 6841909747, flow, declarative-update and same-origin api actions do not need the binding (read).
• It fails closed: nothing runs that should not, and red lines 1 and 2 hold.
• The binding gap is older than this PR. It also hits the one-holder route on main, where the bare read serves the environment's item and the row is not bound (measured above).
• The fix, in this PR's text:
  • Narrow body row 1's TO and the changeset's TO to "the environment's declaration is served".
  • Add row 3's shape to the changeset (the environment's object-less item answers lead); it leaves that out today (contract review nit).
  • In the body and the changeset, ground the disabled-package answer in main's own answer, not ruling A (nit 1).
• The binding gap is objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990, not this PR's.

Red line 1: resolution is never loosened

• Holds (measured, head against BASE, both registration orders).
  • Two kinds of cell move: the PR's rows 1 to 3 (lead was no declaration, now the environment's item, no package). And a disabled package that binds another object (account), whose state answers lead with the environment's item at the head and no declaration on BASE.
  • Unchanged:
    • An enabled third package on lead, or one with an object-less action: answers it.
    • A disabled package on lead, or a disabled object-less one: no declaration.
    • One holder disabled: no declaration.
    • The platform's item with no row: no declaration.
    • Each holder's own route.
• The new arm is reached only when every candidate's own address answered and none owns the route. A candidate that could not be read leaves the refusal standing (read).

Red line 2: ambiguity is reported, never guessed

• Holds.
  • environmentOwnerOfUnheldRoute reads the registry's listing (disabled packages included) and the store. It never calls a holder's exact address (read).
  • Every served answer carries no package, so the dispatch is unqualified (measured).
  • A package item of the name that owns the route, enabled or disabled, bound to lead or object-less, keeps it no declaration (measured).
  • Two holders on the route's key are refused before this arm, as before (read).
• The step that prefers a bound item to an object-less one never sees two items: the registry holds one package-less item per name (measured below).

Red line 3: independently releasable

• Clause-②: yes (widening) and Metadata-protocol: none, the same in the body and the changeset (read with the repo's reader): valid. No protocol or objectql file changes.
• The changeset is a patch on @objectstack/runtime. It is not breaking, so no ADR-0087 entry is owed. The ADR-0087 registration gate and the three changeset gates each exit 0.
• FROM→TO: rows 1 to 3 match the measured cells, except M1's "its handler runs".
• Pins: the touched file passes, 73 of 73. The five claimed ablations reproduce exactly, and the CONTROL stays green in each.

Ablation	Red / green
The recovery answers no declaration in place of the environment's read	3 / 70
The holder check removed	1 / 72
The store origin test removed	1 / 72
A failing store read answered as no declaration	1 / 72
An engine with no store answered as a failing read	1 / 72
A package's object-less action no longer counts as owning the route (mine)	0 / 73
Bound before object-less dropped (mine)	0 / 73

Nits (a follow-up card under #32751; no extra round)

1. Ruling 6824698376 A is cited outside its scope. The code's docblock, the pin's title and the body ground "a disabled package binding the route is still a holder" in letter A. By its text, letter A is a fixed exception of the two permission-set reads to fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497's served-set rule. The answer kept is main's own: with only the environment's item and a disabled package on lead, main answers no declaration (measured). The body's ground is fixed in this PR (M1). The docblock and the pin's title are code and go to the follow-up card, so the head does not move under the contract review.
2. A disabled package's object-less action keeps lead no declaration (measured, head and BASE), but nothing pins it. Removing the object-less half of the holder check leaves the file green.
3. Contract review 6841909747's two unpinned neighbours:
   • an enabled third package on lead (measured: it answers, as on BASE);
   • a candidate address answering not-held-by-qualifier.

Older than this PR

• The binding gap of M1 is carried by objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990 (p2, under runtime action route: an environment action on an object neither of two holders binds cannot run through the bare route once #32568 lands #32751). By triage's measurement it is older than fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 and present at 18.3.0, so it is not a regression and does not hold the release.
• Main splits on a disabled package bound to lead (measured on BASE and at the head). The answer moves with the set of other holders:
  • With the environment's item on lead and no other holder: no declaration.
  • With one enabled holder elsewhere (A on account): the environment's item is served on lead.
  • With two enabled holders elsewhere: no declaration. This PR keeps that cell as it was.
  • 席 C files it as a p2 card under runtime action route: an environment action on an object neither of two holders binds cannot run through the bare route once #32568 lands #32751, queued and not dispatched.
• For the seat to route: the platform and the environment share one package-less slot. A platform item bound to lead and the environment's object-less item replace each other in the registry, and the later registration stays. At the head, with the environment's registered last, lead serves the environment's object-less item, and the handler reached is the lead-bound one (measured with a hand-bound handler). With the platform's registered last, it is no declaration. The same slot rule holds on main's zero-holder bare read.

Epic seat's rulings

1. M1: the text is narrowed here, and the binding gap is its own card (objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990, p2). This PR's TO and changeset say the declaration is served, and the changeset names row 3.
2. Nit 1: the body and the changeset drop ruling A as the ground and say main's answer is kept. The docblock and the pin's title go to the follow-up card.
3. The disabled-package split is a p2 card under runtime action route: an environment action on an object neither of two holders binds cannot run through the bare route once #32568 lands #32751, filed by 席 C.

Measured and read

• Measured:
  • the touched file;
  • every ablation;
  • 20 route cells at head and BASE (10 shapes, both orders), and 2 on the shared slot;
  • the resync binding with 0, 1 and 2 holders;
  • the gates.
• Read only:
  • the dispatch miss and its 404;
  • the arms of routeOwnerOfRefusedRead;
  • contract review 6841909747;
  • CI: 54 check runs, 34 success, 18 skipped, 1 in progress. One failure: PR-body guards (check:closing-target-claim), which the contract review reads as a claim posted after the guard ran.
• Not run: a booted-kernel REST call end to end, and the runtime suite beyond the touched file.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Contract-review-handoff: triage#1 — delta review of the should-fix route 2 (2026-11-13T02:47Z) · head c9732c2

Delta on top of 68ef9c71 (triage PASS 6841909747), one commit, main not chased: the FROM→TO narrowed to "its declaration is served" (body rows 1 and 3 plus the paragraph after the table; the handler binding gap is #32990, p2, not a regression: the name filter predates #32741); the changeset narrowed the same way plus the object-less sentence; two neighbour pins (an enabled third package bound to lead, both orders; a not-held-by-qualifier candidate keeps the refusal), each with an ablation that went red. 75/75; 24 affected gate families re-run, all exit 0; runtime typecheck exit 0. Body patched to r2.

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line text re-read · 2026-11-13T02:48Z

Head-sha: c9732c20f9354b7ec499ca3aca065876a9fa3a00
Verdict: PASS. M1 of 6842078446 is closed in the text, as the epic seat ruled.

Read: the one commit since 68ef9c7, with no merge of main. It changes the changeset and adds two pins to the touched test file. action-execution.ts is byte-identical to 68ef9c7. Also read: the body's revision r2 on the PR.

• The TO is narrowed to the declaration.
  • The changeset's headline and its FROM → TO now say the environment's action declaration is served. A closing sentence says whether a script-bodied action then runs on a booted host is a separate binding question.
  • The body's rows 1 to 3 say the same. The paragraph after the table names the 404 at dispatch on a booted host and objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990.
  • This matches 6842078446's measurement: the resync binds the row with no package holder, and not with one or two.
• Row 3 is in the changeset: an environment item with no object answers on lead too.
• The disabled-package answer is grounded in main's answer, in the changeset and the body ("which keeps main's answer there", "as on main"). Neither cites ruling A any more. The docblock and the pin's title still cite it, as ruled (follow-up card).
• The two new pins are contract review 6841909747's neighbours.
  • An enabled third package on lead answers its own declaration, in both orders. It equals my BASE cell, so it is a CONTROL by nature.
  • A not-held-by-qualifier candidate keeps the bare read's refusal. With the unread-candidate guard removed (my wording), 2 tests go red: this pin and metadata-protocol: a bare by-name read of an action name that two packages bind to two different objects is refused, naming both (ADR-0150 D3; after #31697) #32244's older one.
• Unchanged: Clause-②: yes (widening) and Metadata-protocol: none, the same in the body and the changeset (read with the repo's reader).
• At this head:
  • The touched file passes, 75 of 75.
  • The ADR-0087 registration gate and the three changeset gates each exit 0.

Nit, for the follow-up card. The changeset's "an item bound to lead comes before one with no object", and the same words in body row 3, describe a case the registry cannot hold: it keeps one package-less item per name (measured in 6842078446). The text is not wrong, only unobservable.

The nits of 6842078446 stay on the follow-up card under #32751, as ruled.

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head c9732c2 · 2026-11-13T02:49Z

Delta review over the PASS 6841909747 (its should-fix, taken as route 2), by the same reviewer, at TIER_DEFAULT.

[objectstack-fleet]

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: TIER_DEFAULT
Head-sha: c9732c20f9354b7ec499ca3aca065876a9fa3a00
Local-runs: none

This is a delta review over this reviewer's PASS on 68ef9c71. Same face: declaration, owed by Clause-②: yes (widening) alone.

The hop 68ef9c71...c9732c20 is one commit, c9732c20. It has a single parent, is 1 ahead and 0 behind, and does not merge main. It touches two paths: .changeset/env-action-bare-route-unheld-object.md (+5 −3) and packages/runtime/src/action-package-addressing.test.ts (+35 −0). packages/runtime/src/action-execution.ts has no changes in the hop, so the code judged on 68ef9c71 stands as judged.

Inputs: the compare diff, the PR body at the new head, card #32990, and the check-runs on c9732c20.

① Derived judgments

The should-fix from 68ef9c71 is resolved, by route 2 (narrow the claim and file the gap).

• Changeset. The title and the FROM → TO now read "the environment's own action declaration". The old sentence "so the environment's action could not run there … It used to run only because …" is gone. A closing paragraph says the change serves the declaration, and that whether a script-bodied action then runs on a booted host is a separate binding question.
• PR body. The 维护者速读 and FROM → TO rows 1–3 now say "declaration". A new paragraph states that a booted host does not yet bind a script-bodied environment action whose name a package also ships, so that action answers 404 at dispatch. It says this was measured with a cold boot, and that flow, update-record and API actions are unaffected. It points to objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990.
• Card objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990. It is open and names isArtifactShippedAction in packages/objectql/src/plugin.ts as the name-only filter. It also records that this filter predates fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741, so the gap is not a regression of this PR.
• What still says "runs its handler". The served pin's test name, and the PR body's Tests line ("its handler runs"), still say this. Both describe the pin itself, which binds a handler by hand and asserts that it runs, so they are accurate as worded. No code comment in action-execution.ts claims that a handler runs.

The new pins cover both neighbours named on 68ef9c71.

• NEIGHBOUR: enabled third package. An enabled third package C bound to lead is added on top of twoHoldersAndEnvironment. That fixture already holds the environment item and its stored row, with the store-reading engine. In both registration orders, lead answers C's own declaration (label: 'gamma', no refusal, not degraded), never the environment item. This pins that the new arm does not pre-empt an enabled holder.
• NEIGHBOUR: not-held-by-qualifier. A stubbed protocol makes the bare read refuse naming A and B. A's own address throws not-held-by-qualifier, and B's address serves B's contact item. The environment item and its row are present, so the environment arm would serve if it were reached. The route keeps the bare refusal naming A and B: no action, not degraded. This pins the unread guard ahead of readEnvironment().
• What the stub bypasses. The stub replaces the protocol, so this pin tests the route's branch logic, not the protocol's own not-held-by-qualifier production. That is a reasonable scope for a branch pin.

Nit from 68ef9c71, resolved. The registry-copy read is unchanged and stays a nit. The way out is still the dev's out-of-scope finding (a): the _env address answers 404 here. It is not raised again.

No new findings in the hop.

② Semver level

@objectstack/runtime patch, unchanged. Clause-②: yes (widening) and Metadata-protocol: none still start their lines in the changeset and in the PR body.

Nit from 68ef9c71, resolved. The changeset now names the object-less shape: "An environment item with no object answers on lead too, and an item bound to lead comes before one with no object."

The changeset now says outright that a route an enabled package binds "answers that package's own action, as before". The new enabled-holder pin backs this. The changeset text matches the tree.

③ Boundary flags

• Scope. The hop holds a test and a changeset only. It changes nothing in packages/metadata-protocol, packages/objectql or packages/spec, and touches no governed path. Red line 2 and ruling 6824698376 A stand as judged on 68ef9c71.
• The enabled-holder pin also freezes an existing answer. With both the environment item and C bound to lead, the route answers C rather than refusing. This is not new behaviour: it follows from seat ruling B, under which the execution face does not weigh a package-less holder. If a later card makes the execution face weigh it, that card will have to change this pin on purpose.
• CI on c9732c20. PR-body guards (claim · duplicate · Part-of · single-writer path) is now green; both of its runs are success. No check-run has failed. 21 are success, 18 are skipped, and 13 are still in_progress: Build Core, both Lint lanes, Test Core 1–8, and both Type Check lanes. The PR is still a draft, and merge waits for a fully green head.
• Out-of-scope findings. Findings (a) and (b) from 68ef9c71 are still not filed as cards. The handler-binding gap is now objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990.

Implemented-by: claude/project-thread-svxbge
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

Regen-provenance: 6842378225 · c9732c2 → fd531c3 · diff of git diff 25ee5076 c9732c20 -- . ':!.changeset' | grep -vE '^(index |@@)' against git diff 04c35f09 fd531c37 -- . ':!.changeset' | grep -vE '^(index |@@)' → (empty)

Read at 2026-11-13T03:36Z. The head moved by one merge of main (fd531c37, parents c9732c20 and 04c35f09, 23 first-parent commits) after triage's delta PASS 6842378225 and the epic red-line text re-read PASS 6842317355 on c9732c20. The remerge diff is empty (git show --remerge-diff, 0 lines). Outside .changeset/ the PR's delta against its merge base is the same hunk for hunk; only the blob index lines and the @@ line offsets differ, because main added 27 lines above this PR's region of action-execution.ts (AI exposure and flow start, no overlap with the functions this PR edits). The changeset delta is byte-identical. So record 6842378225 carries to this head (contract-review.md, head-moved exception).

---

Generated by Claude Code

[objectstack-fleet]

domain:server#4 · os-sales · session_01L6bhgWRcTEB3toGxnWvuvX

席位核对 — ACCEPT · fd531c373a52c68892e75ff7a567022ac0fdd8d7 · 2026-11-13T03:56Z

• 形态: draft → main, Fixes #32751. 3 files, +229/−11 (packages/runtime/src/action-execution.ts, its addressing test, one changeset), under 3000 lines. No governed path, no packages/spec/src/** path; face = the Clause-②: yes (widening) declaration ⇒ TIER_DEFAULT.
• 契约复审: triage PASS 6841909747 on 68ef9c71 with one should-fix (a booted host does not bind a script-bodied environment action whose name a package also ships); epic red-line read HOLD 6842078446 (M1, same point) with the epic seat's ruling: narrow the text here, carry the binding gap on its own card. Triage delta PASS 6842378225 and epic red-line text re-read PASS 6842317355 on c9732c20; carried to this head by Regen-provenance 6843039361 (one main merge, remerge diff empty, PR delta unchanged hunk for hunk).
• 前提实测: after metadata-protocol: a package-less item of a two-holder name is still served at both exact addresses on the draft and preview reads and for hook, job, queue, sharing_rule and assignment_rule (ADR-0150 D4, after #32407) #32568 the bare route answered no declaration for the environment's own action on an object neither of two holders binds; the PR serves the environment's declaration there, keeps every holder's own route, a disabled holder and a not-held-by-qualifier candidate as on main (8 pins, 7 ablations red, dev report 6841728228 and the thread's readings).
• 散文面逐句核 (seat): changeset (patch, Clause-②: yes (widening), Metadata-protocol: none) and the PR body r3 say "declaration served" and name objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990 for the handler binding; both match this head.
• 门禁 check-runs on this head: 37 success, 18 skipped, 0 failure, newest run per name (Test Core shards, Build Core, Type Check and Lint lanes, Changeset, PR-body guards, Queue Guard). Merged main twice, never rebased (25ee5076 before the PR, 04c35f09 before the queue at K = 23); K = 7 since, under 15. Thread's run on this head after a full rebuild: test file 75/75, runtime typecheck exit 0, 66 derived gate families run, 0 NOT-MEASURED, all exit 0.
• 接受的偏差: none beyond the PR body's declared surface.
• 范围外去向: runtime action route: the environment's exact address /actions/_env/:object/NAME answers 404 while a package holds the same name #32988 (_env exact address 404), runtime action route: a served holder's own action route answers "no declaration" when the other holder is disabled and the environment has its own item of the name #32989 (served holder's route with a disabled co-holder), objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990 (objectql binding by owner key), runtime action route (#32751 follow-up): stop citing ruling A for the disabled-holder answer in code, and pin a disabled package's object-less action #32995 (review nits: ruling-A citations in code, object-less disabled pin, unobservable wording), runtime action route: the bare route's answer with a disabled package on the object depends on the other holders and on registration order (pre-existing on main) #32996 (disabled-holder split and the shared package-less slot); all subs of runtime action route: an environment action on an object neither of two holders binds cannot run through the bare route once #32568 lands #32751, p2 queue.
• 落地条款: non-governed, review of record PASS carried to this head ⇒ seat lands: ready + auto-merge.

---

Generated by Claude Code