fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) - #33126

📓 Docs Drift Check

13 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ef1fd06e9b0f8e4b98997b50758b3874068f70a5 && git checkout ef1fd06e9b0f8e4b98997b50758b3874068f70a5
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a83c366702b26d653a975d533dde4dabb30030e1 616dbbda179dbafe42143eb1f748e9a85a91c94f && git checkout -B drift-repro a83c366702b26d653a975d533dde4dabb30030e1 && git merge --no-ff 616dbbda179dbafe42143eb1f748e9a85a91c94f

node scripts/docs-audit/affected-docs.mjs --json a83c366702b26d653a975d533dde4dabb30030e1

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head c0b7cb1 · 2026-11-13T16:06Z

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c0b7cb13cb11498031bde97a8673982e7dbb58ac
Local-runs: none
Scope: packages/metadata-protocol/src/protocol-lock-state.ts, packages/metadata-protocol/src/protocol-meta-list-reads.ts, packages/metadata-protocol/src/protocol-registry-hydration.ts, packages/metadata-protocol/src/stored-flow-slot.ts, packages/metadata-protocol/src/stored-flow-slot.test.ts, packages/objectql/src/protocol-flow-custom-override.test.ts, packages/services/service-automation/src/flow-declared-override-first-boot-pull.integration.test.ts, .changeset/32613-two-holder-override-slots.md (its declaration lines and level) + read as cited code, not reviewed: packages/metadata-protocol/src/served-override.ts, protocol-package-bindings.ts (SEALED_ROW_SERVED_OVERRIDE_TYPES), protocol-environment-rows.ts (shippingPackageIds, soleShippingPackage), protocol-artifact-lookup.ts, the two callers of hydrateOverlayIntoRegistry in protocol-meta-list-reads.ts and protocol-diff-delete-load.ts, getArtifactItem in packages/objectql/src/registry.ts, AGENTS.md Post-Task step 3.

First round, read at 2026-11-13T16:12Z. Inputs: card #32613 with claim 6855902049 and report 6858019637, the PR body, the diff against merge base 2c98485d (eight files), the knocks 6858065729 and 6858122699. Claim 6858311083.

① Derived judgments

• Clause-②: no (narrowing) is right for what the PR names: the env-wide lists stop serving entries they served, and no export or accepted input widens. incomingTakesStoredFlowSlot changes its third parameter, but the package entry does not export it (only shadowedStoredRowsOf), so no published signature moves.
• Metadata-protocol: none is right: nothing an author can write is added, refused or given a new meaning. A declared override always meant "serve this in place of the package's item"; the runtime now honours it for the second holder too.
• The declared scope is narrower than the code in two places (M1, S1).

② Semver level

• patch on @objectstack/metadata-protocol follows from none. The ! title and the BREAKING banner are kept, as a (narrowing) arm requires.
• adr-0087: not-required (no-migration-prescription) is admitted for the kind none, and the reason given holds: no key and no stored shape moves.
• M1 and S1 change what the BREAKING line must name, not the level.

③ Boundary flags

• Check-runs are not read for this verdict: a FAIL does not wait on them.
• File surface: inside claim 6855902049 (the four metadata-protocol files and tests).
• Fixes #32613 closes the card. The census twin metadata-protocol: the boot census reports a second holder's served declared override as unserved and prescribes deleting the stored row #32859 is carried by the report.
• Order, from the PR: after fix(metadata-protocol)!: a package-less row at a holder's exact address answers one thing on every read and in every hydration state: declined for a sealed type, refused with two holders for an overlay type (ADR-0150 D4) #32741 (merged), before metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552 (PR fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129, knocked to this seat, not read yet); metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled #32820 shares protocol-registry-hydration.ts and runs after.
• main is four commits past the merge base, none on a path of this diff.
• The PR lists os-elon-musk as requested reviewer, which is the seat's own account. The seat's.
• The ablation readings are the report's and were not run here.

④ Design judgment

packages/metadata-protocol/src/stored-flow-slot.ts, protocol-registry-hydration.ts (the boot pull). Holds. A row is an override when it declares the override of any package that ships the name, each judged through its own pair by the one predicate. With two holders' overrides the later one takes the bare slot and carries the other, and a package-less row read after either is carried and never takes the slot. The slot is transport only, as the docblock now says. The unit pins hold both orders, the FROM case and a pair that declares a non-shipper; the integration pins read what the first pull armed. The single-shipper path is the same code with a set of one.

packages/metadata-protocol/src/protocol-meta-list-reads.ts (the lists). The rewrite keeps the three old outcomes: no shipper and a bound shipper keep the item, one shipper narrows as before (soleShippingPackage was already "exactly one id"). The new branch drops, under two or more shippers, an item bound to a pair whose body declares a shipper's override. It is judged on the item's binding and body, never on a stamp. Right for the case the card names; see S1 for its reach.

packages/metadata-protocol/src/protocol-lock-state.ts (declinesStoredRow). The flow branch is the same judgment moved into a helper; the added guard for a missing row answers as before. The last branch is where the diff does more than it says (M1).

Findings:

• M1 must-fix. The every-shipper judgment also moves six sealed types, unnamed and unpinned. Derived from the code, not run. The last return of declinesStoredRow reads (servesSealedOverrideRow(type) || action) && servedOverrideOfAShipper(type, name). On main both arms judged the row against packagedArtifactOwner alone; this diff moves both arms to every shipper. servesSealedOverrideRow is page, app, dataset, doc, book and mapping. So for those six, the second holder's declared override goes FROM declined (its shipped item served) TO served, at its own address and wherever the reads ask this gate. The docblock, the PR table, the changeset and the BREAKING line say action; the new pins cover flow and action. dataset and mapping are held per namespace since objectql: narrow the phase-1 one-holder refusal from environment to namespace for picklist, mapping, dataset, api and function (ADR-0150 child B, picklist family) #31700, so two holders are reachable today, and a mapping's by-name read is the one the import door resolves through. For page, app, doc and book, where two packages ship one name, what a read naming no package answers once two overrides are served is not shown. The direction is ADR-0150 D4's own. Owed, one of: keep the every-shipper judgment to action here and file the six; or keep it, pin one sealed type in both registration orders (each address, the lists, the read naming no package) and name the six in the FROM → TO table and the changeset.
• S1 should-fix. The list filter moves every type, and the declaration names two. The new branch runs for every request.type but package. The Clause-②: line is worded for "a name", but the title, the BREAKING line (GET /meta/flow, GET /meta/action) and the table say flow and action. By the same code the pair's entry leaves the env-wide list of any type that serves a declared override under a name two packages ship (a dashboard, a report, an email template). Whether main listed that entry for those types is not measured here. Say which types move, with one pin on an overlay type, or scope the branch to the two the card names.
• S2 should-fix. For an action, the pins stop at the protocol's reads. The card asks the sweep to cover "the other execution-face readers" for flow and action. The flow's boot pull is pinned. For an action the pins read the two lists, the by-name read, the layered read and the served-overrides list. The hydrator still registers an action's override row under the bare name, wearing the envelope lookupArtifactItem answers for the pair's id; a pair ships no artifact, so getArtifactItem falls to the first composite of the name, the first shipper's. This diff does not touch that and main does the same, so it is no regression. But what a registry reader gets for each holder, in each order, is neither pinned nor named as carried. Pin it, or carry it by name to the card that follows on this face.
• n1 nit. The mixed case is not pinned: two shippers, one with a declared override and one without. The filter and the gate both reach it.

M1 is the ground of this verdict. The delta on the next head is this seat's.

Implemented-by: session_016WV4cwJFqk2CMKeRryL5aB
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 616dbbd · 2026-11-13T17:35Z

Delta of FAIL 6858448985, after knock 6860158958.

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 616dbbda179dbafe42143eb1f748e9a85a91c94f
Local-runs: none
Scope: packages/metadata-protocol/src/protocol-lock-state.ts, packages/metadata-protocol/src/protocol-meta-list-reads.ts, packages/objectql/src/protocol-flow-custom-override.test.ts, packages/metadata-protocol/src/protocol-registry-hydration.ts, packages/metadata-protocol/src/stored-flow-slot.ts, packages/metadata-protocol/src/stored-flow-slot.test.ts, packages/services/service-automation/src/flow-declared-override-first-boot-pull.integration.test.ts, .changeset/32613-two-holder-override-slots.md (its declaration lines and level) + read as cited code, not reviewed: declinesStoredRow on main (packages/metadata-protocol/src/protocol-lock-state.ts), card #33131 and its two comments, card #32552, the record 6859128505 on PR #33129.

Delta review of FAIL 6858448985, read at 2026-11-13T17:54Z. Inputs: the interdiff c0b7cb13..616dbbda (one commit, four files, no merge of main), the PR title and body as they stand, report 6860120438, the check-runs on this head, the knock 6860158958. Claim 6860332620. Everything the earlier record judged and the interdiff does not touch stands as read there: the boot-pull files of the Scope line are unchanged since c0b7cb13.

① Derived judgments

• Clause-②: no (narrowing) and Metadata-protocol: none stand as judged in the earlier record.
• The declaration and the code now name the same two types. flow and action move; the changeset, the PR table and the BREAKING line say so, and the code moves nothing else (M1, S1 below).
• The mixed case (one holder overridden) is not claimed: the title and the changeset speak of a name where each package has its declared override.

② Semver level

• patch on @objectstack/metadata-protocol, the ! title, the BREAKING banner and adr-0087: not-required (no-migration-prescription): unchanged, and right as before.

③ Boundary flags

• Check-runs on this head, all concluded: 55 runs, 37 success, 18 skipped, none failed. The eight Test Core shards and Check Changeset are green.
• main is nine commits past the merge base 2c98485d, none on a path of this diff.
• Fixes #32613 and the mixed case. The card's expected answer (both overridden, both orders, flow and action, a one-holder CONTROL) is met. Its first fix-shape bullet (a bound override row is "never taken by the bare slot when two packages hold the name", flow and action) is not met for an action when only the second-registered holder is overridden: the first holder's slot on the served list and the execution view then carries the second holder's override. By the report's reading with the owner-only judgment put back, that is main's answer too, and this diff does not make it; it is recorded on metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 (6858574856). The card also says metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552 waits on it because an action "shows the same wrong entry (alpha:OVERRIDE-beta when alpha registers first)", which is the shape that pin still measures. Whether the card closes here or reads Part of, and whether fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129 may land ahead of metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131's item 3, is the seat's.
• metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131's triage note (6858501842) says item 3 "matches main" and carries no defect yet. The measured case was written three minutes after it: the execution view, which the engine arms from, lists one package's action slot with another package's override. A re-grade is the seat's to ask for; this seat does not grade.
• PR fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129 (PASS 6859128505, head c35a911b, unchanged). Its s1 named this branch: M1 was closed by leaving the six sealed types on the first-holder judgment, so its census, which leaves out a row that is the declared override of any shipper for every type, would stop naming a second holder's override of those six while the reads still decline it. Owed there before it lands: the census judges every shipper for flow and action only, or waits for metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131's item 1.
• The ablation readings, the mixed-case reading on main and the local runs are the report's; none was run here.
• The PR lists os-elon-musk as requested reviewer, the seat's own account. The seat's, as before.

④ Design judgment

packages/metadata-protocol/src/protocol-lock-state.ts (M1). Fixed, by the first of the two options. action takes its own return and is judged against every shipper through servedOverrideOfAShipper; the six sealed types return on the expression main has, isServedOverrideRowOf(row, this.packagedArtifactOwner(…), installed), so nothing moves for them. The changeset says so and carries them to #33131 (item 1).

packages/metadata-protocol/src/protocol-meta-list-reads.ts (S1). Fixed. Under two or more shippers the pair-slot drop runs for flow and action (TWO_HOLDER_PAIR_SLOT_TYPES, read through the plural map); any other type keeps the item, which is main's answer in that branch. Carried to #33131 (item 2).

packages/objectql/src/protocol-flow-custom-override.test.ts (n1). The mixed case is pinned in both orders with either holder overridden. For a flow the lists and both addresses are exact. For an action the pin holds the overridden holder's own slot and address and says in its comment what it leaves out.

S2. Carried by name: the PR body, the changeset and #33131's item 3 name the action's registry face, with the measured case.

Findings:

• n1 nit. The changeset's carry sentence calls the residual "what a registry reader gets for each holder of an action name". The mixed pin shows it on the protocol's own served list and execution view (the first holder's slot, when only the second holder is overridden). The PR body says so; the changeset is what a release reader gets, and one sentence there would say the same.
• n2 nit. The action half of the mixed pin leaves the other holder's slot unpinned in both sub-cases. By the pin's own comment the leak needs the second-registered holder to be the overridden one, so with the first-registered holder overridden the lists could be pinned exactly, as the flow's are.

No must-fix. M1, S1 and n1 of record 6858448985 are closed on this head; S2 is carried by name.

Implemented-by: session_016WV4cwJFqk2CMKeRryL5aB
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-13T17:55Z · head 616dbbda179dbafe42143eb1f748e9a85a91c94f

Verdict: ACCEPT: Fixes #32613. Not governed, 8 files, +388 / −25 (check-governed-merges --pr 33126). This seat (the sole epic seat of #31527) lands it, per the maintainer's order to carry the epic's already-branched p2 cards to merge and the standing order that seats review and land with pm-dispatch.

席位核对

1. Shape: draft PR to main, Fixes #32613; files inside the re-posted claim 6855902049.
2. Reviews: review#1 FAIL 6858448985 on c0b7cb13 (M1, S1, S2, n1); delta PASS 6860735256 on this head, no must-fix: M1 and S1 closed by scoping to flow and action (the six sealed types keep main's first-holder judgment), n1 pinned, S2 carried by name; two nits left for a later push.
3. Seat's calls on the boundary flags of 6860735256:
   • Fixes, not Part of. The card's expected answer (both holders overridden, both orders, flow and action, one-holder CONTROL) is met. The one fix-shape case left open, an action whose second-registered holder alone is overridden showing that override in the first holder's slot, is main's answer, not made by this diff, and is carried with the measured case to metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 (comment 6858574856). A re-grade of metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 item 3 is asked of triage separately.
   • fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129 (metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552) lands after this PR and aligns its census to flow and action first (its s1); it does not land ahead of metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131's items.
4. Since the delta: no push. The PR body was refreshed to this head by the seat before the delta review.
5. Gates on this head: 37 check-runs success, 18 skipped, none failed or pending; the eight Test Core shards and Check Changeset green. Local on this head (report 6860120438): whole-tree build, 72/72 derived gates (0 NOT-MEASURED), metadata-protocol and objectql suites, typecheck, lint, full dogfood 460 files passed. K = 11 behind main, under 15, none on a path of this diff: no merge before queueing.
6. Serial: metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled #32820 shares protocol-registry-hydration.ts and starts from main after this merges; metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552's PR fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129 merges main once after it.
7. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613 closes.