fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4)

.changeset/32552-pair-row-removal-every-shipper.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first — its removal, its commit revert and the boot census (ADR-0150 D4)
+
+Clause-②: yes (widening) — answers that refused or misreported the second-registered holder's declared override now admit or leave it, as they already did for the first. For a name two packages of two namespaces ship, each with its paired `.custom` holding a declared override (ADR-0146 D2), three answers depended on which package registered first, because each judged the pair's row against the one package the bare-name artifact lookup answers. Each is now judged against every package that ships the name. First-party callers in any of these positions: 0.
+Metadata-protocol: none
+
+Every row below is the `widening` arm, is pinned in both registration orders in `@objectstack/objectql`'s `protocol-flow-custom-override.test.ts`, and keeps its one-holder answer (the one-holder CONTROL there):
+
+| Door | Second-registered holder B, before | Now | One holder (CONTROL) |
+|:--|:--|:--|:--|
+| `DELETE /meta/TYPE/NAME?package=<B>.custom` (`deleteMetaItem`); pinned for a flow, and for an action in the list probe below | `403 NOT_OVERRIDABLE` "sealed against removal"; B's override stays | `200`: B's override row removed (runtime-only), A's untouched; afterwards every listed and execution-view entry of the name is its own package's | unchanged: `200`, removed |
+| `revertCommit` of a commit into `<B>.custom` (the restore limb; the per-item rollback shares the derivation); pinned for a flow | the item in `failed[]`, `NOT_OVERRIDABLE` "sealed against in-place edits"; nothing restored | restored, judged by the override write gate as the pair's declared override | unchanged: restored |
+| boot census `[metadata_sealed_overlay_unserved]` (`loadMetaFromDb`), a flow or an action only | named B's live declared override as an unserved row to delete | not named | unchanged: the override not named |
+
+With one of the two holders disabled (ADR-0150 D3), the bare-name answer is still the first-registered holder, disabled or not, so the same three answers moved the same way whichever holder is disabled: each holder's pair removal and commit revert are admitted now, the disabled holder's pair included, and the census names neither override. A binding never moves with a reversible disable. Pinned in both registration orders with each holder disabled in turn, beside a one-holder disabled CONTROL (its removal and revert admitted, as before).
+
+Unchanged in both: a row of a package that is no shipper's pair keeps its removal `403` and is still named by the census.
+
+The census judges a row as the reads serve it (`declinesStoredRow`). The reads serve a second holder's declared override per shipper for a flow and an action only (#32613), so only those two types move here. A page, app, dataset, doc, book or mapping keeps the name's first-registered shipper in the census, as in the reads, until #33131 moves them: the second holder's override of such a name is still named, pinned for a mapping in both registration orders.
+
+No shipper is picked: the row judged is always the one its own `package_id` names, and the judgement asks only whether that package is a pair of SOME package that ships the name. A name one package ships answers exactly as before (the bare-name answer is read first and alone while it holds).

packages/metadata-protocol/src/protocol-class-head.ts

@@ -41,6 +41,7 @@ import { PLURAL_TO_SINGULAR } from '@objectstack/spec/shared';
 import type { IObjectQLEngine, IPubSub } from '@objectstack/spec/contracts';
 import { isPairOf } from '@objectstack/metadata-core';
 import { installedManifestsOfEngine } from './installed-manifests.js';
+import { someShipperOf } from './protocol-environment-rows.js';
 import { overrideWriteRefusalError } from './protocol-packaged-base-refusal.js';
 import { OBJECT_EXTENSION_TYPE, registrableObjectExtension } from './protocol-object-extension-item.js';
 import type { ObjectExtensionRegistry } from './protocol-object-extension-item.js';
@@ -201,13 +202,17 @@ export class ProtocolClassHeadFacet {
      * caller's `artifactBacked` decides the intent, and the body writer is
      * {@link restoredBodyWriter}'s alone.
      */
-    static restoreWriteFor(host: Pick<ProtocolHost, 'engine' | 'overrideWriteVerdict' | 'packagedArtifactOwner' | 'restoredBodyWriter'>, singularType: string,
+    static restoreWriteFor(host: Pick<ProtocolHost, 'engine' | 'overrideWriteVerdict' | 'packagedArtifactOwner' | 'restoredBodyWriter' | 'shippedArtifactsOf'>, singularType: string,
             name: string,
             binding: string | null,
             artifactBacked: boolean,
             source: string,): { intent: 'override-artifact' | 'runtime-only'; deriveRestoredBody: (historyBody: unknown) => Promise<unknown> } {
-        const owner = artifactBacked ? host.packagedArtifactOwner({ type: singularType, name }) : undefined;
-        const pairRow = owner !== undefined && isPairOf(binding, owner, installedManifestsOfEngine(host.engine));
+        // [ADR-0150 D4, #32552] The binding is judged against every package
+        // that ships the name ({@link someShipperOf}): each namespace's holder
+        // has its own pair, never only the shipper registered first.
+        const installed = installedManifestsOfEngine(host.engine);
+        const pairRow = artifactBacked && someShipperOf(host, singularType, name,
+            (owner) => owner !== undefined && isPairOf(binding, owner, installed));
         const intent: 'override-artifact' | 'runtime-only' = artifactBacked && !pairRow ? 'override-artifact' : 'runtime-only';
         const writeRestored = host.restoredBodyWriter(singularType, name, binding, source);
         const deriveRestoredBody = pairRow

packages/metadata-protocol/src/protocol-diff-delete-load.ts

@@ -39,12 +39,13 @@ import { isMissingTableError } from '@objectstack/metadata/errors';
 import { PLURAL_TO_SINGULAR } from '@objectstack/spec/shared';
 import { isServedOverrideRowOf } from './served-override.js';
 import { installedManifestsOfEngine } from './installed-manifests.js';
+import { someShipperOf } from './protocol-environment-rows.js';
 import type { ServedOverrideRow } from './served-override.js';
 import { REFERENCE_SITES } from './reference-sites.js';
 import { computeMetadataDiagnostics } from './metadata-diagnostics.js';
 import { hasMetadataRedactor, redactMetadataItem } from './metadata-redaction.js';
 import { isPairRowRemoval } from './protocol-packaged-base-refusal.js';
-import { canonicalizeMetaRequestType } from './protocol-meta-type-schema.js';
+import { canonicalMetaType, canonicalizeMetaRequestType } from './protocol-meta-type-schema.js';
 import { boundPackageOf } from './protocol-package-bindings.js';
 import { remainingRowsPhrase } from './protocol-authoring-refusals.js';
 import { memberOption, mutationEventMember, resolveBundleMemberSelector } from './protocol-bundle-members.js';
@@ -391,7 +392,7 @@ export class ProtocolDiffDeleteLoadFacet {
     }
 
     /** [#28355] The body of {@link deleteMetaItem} before its refusal audit; that method's docblock is the contract. */
-    static async deleteMetaItemUnaudited(host: Pick<ProtocolHost, 'assertLockAllowsDelete' | 'dropObjectStorage' | 'dropStorageRemainingRowsRefusal' | 'emitMetadataMutation' | 'engine' | 'environmentId' | 'findEnvironmentRow' | 'getOverlayRepo' | 'isArtifactBacked' | 'isOverlayAllowed' | 'isRuntimeCreateAllowed' | 'metadataConflictRefusal' | 'originGatedRemovalRefusal' | 'packagedArtifactOwner' | 'packagedBaseRefusal' | 'packagelessAddress' | 'packagelessDraftAddress' | 'packagelessOverlayWriteRefusal' | 'recordMetadataAudit' | 'recordOptimisticConflictAudit' | 'refuseOrganizationScopedWrite' | 'refusePackagedBaseRemoval' | 'registryAllowsOverlay' | 'restoreArtifactRegistryView' | 'runMutationProjector' | 'shouldDropStorage' | 'storedParentForToken'>, request: DeleteMetaItemRequest): Promise<{
+    static async deleteMetaItemUnaudited(host: Pick<ProtocolHost, 'assertLockAllowsDelete' | 'dropObjectStorage' | 'dropStorageRemainingRowsRefusal' | 'emitMetadataMutation' | 'engine' | 'environmentId' | 'findEnvironmentRow' | 'getOverlayRepo' | 'isArtifactBacked' | 'isOverlayAllowed' | 'isRuntimeCreateAllowed' | 'metadataConflictRefusal' | 'originGatedRemovalRefusal' | 'packagedArtifactOwner' | 'packagedBaseRefusal' | 'packagelessAddress' | 'packagelessDraftAddress' | 'packagelessOverlayWriteRefusal' | 'recordMetadataAudit' | 'recordOptimisticConflictAudit' | 'refuseOrganizationScopedWrite' | 'refusePackagedBaseRemoval' | 'registryAllowsOverlay' | 'restoreArtifactRegistryView' | 'runMutationProjector' | 'shippedArtifactsOf' | 'shouldDropStorage' | 'storedParentForToken'>, request: DeleteMetaItemRequest): Promise<{
             success: boolean;
             message?: string;
             reset?: boolean;
@@ -427,10 +428,13 @@ export class ProtocolDiffDeleteLoadFacet {
         // flow's armed) again. Admitted past the sealed-removal refusal and
         // told to the store as a runtime-only removal, as the declared save
         // is ({@link isPairRowRemoval}).
-        const pairRowRemoval = isPairRowRemoval(
-            request.type, host.packagedArtifactOwner({ type: request.type, name: request.name }), request.packageId,
-            installedManifestsOfEngine(host.engine),
-        );
+        // [ADR-0150 D4, #32552] Judged against every package that ships the
+        // name ({@link someShipperOf}): two namespaces' items of one name each
+        // carry their own pair, so the pair named here is judged against its
+        // own base, never against whichever shipper registered first.
+        const installed = installedManifestsOfEngine(host.engine);
+        const pairRowRemoval = someShipperOf(host, request.type, request.name,
+            (base) => isPairRowRemoval(request.type, base, request.packageId, installed));
         // Two-tier authorization for delete (mirrors saveMetaItem).
         //  • Artifact-backed item → delete becomes a tombstone overlay,
         //    requires `allowEnvironmentOverlay`…
@@ -1105,7 +1109,7 @@ export class ProtocolDiffDeleteLoadFacet {
     }
 
     /** The body of `ObjectStackProtocolImplementation#loadMetaFromDb`; the method's docblock there is its contract. */
-    static async loadMetaFromDb(host: Pick<ProtocolHost, 'classifyObjectContribution' | 'convertStoredItem' | 'engine' | 'ensureOverlayMembersBackfilled' | 'findEnvironmentRows' | 'hydrateOverlayIntoRegistry' | 'isHostCodeDatasource' | 'isUnservedSealedOverlay' | 'overlayPackageMismatchError' | 'packagedArtifactOwner' | 'packagelessAddress' | 'reportPageRequiresAbsentAtLoad' | 'reportSealedOverlayRows' | 'resolveSduiManifest' | 'storeHydratedIntoRegistry'>): Promise<{ loaded: number; errors: number; invalid: number; storeUnavailable: boolean }> {
+    static async loadMetaFromDb(host: Pick<ProtocolHost, 'classifyObjectContribution' | 'convertStoredItem' | 'engine' | 'ensureOverlayMembersBackfilled' | 'findEnvironmentRows' | 'hydrateOverlayIntoRegistry' | 'isHostCodeDatasource' | 'isUnservedSealedOverlay' | 'overlayPackageMismatchError' | 'packagedArtifactOwner' | 'packagelessAddress' | 'reportPageRequiresAbsentAtLoad' | 'reportSealedOverlayRows' | 'resolveSduiManifest' | 'shippedArtifactsOf' | 'storeHydratedIntoRegistry'>): Promise<{ loaded: number; errors: number; invalid: number; storeUnavailable: boolean }> {
         let loaded = 0;
         let errors = 0;
         let invalid = 0;
@@ -1173,13 +1177,25 @@ export class ProtocolDiffDeleteLoadFacet {
                         // would prescribe deleting the live customization. The
                         // one predicate, on the row's `package_id` column. The
                         // census only: what this loop loads is unchanged.
+                        //
+                        // [ADR-0150 D4, #32552] …judged as the reads judge it
+                        // (`declinesStoredRow`): for a flow and an action
+                        // against every package that ships the name
+                        // ({@link someShipperOf}), so a second holder's
+                        // served override is not named for deletion; for the
+                        // six sealed types against the name's first-registered
+                        // shipper alone, which is the only override the reads
+                        // serve for them until #33131 moves them.
+                        const servedOverrideOf = (base: string | undefined) => isServedOverrideRowOf(
+                            record as ServedOverrideRow, base, installedManifestsOfEngine(host.engine),
+                        );
+                        const recordName = String(record.name);
+                        const perShipperType = ['flow', 'action'].includes(canonicalMetaType(normalizedType));
                         if (
-                            !host.isHostCodeDatasource(normalizedType, String(record.name))
-                            && !isServedOverrideRowOf(
-                                record as ServedOverrideRow,
-                                host.packagedArtifactOwner({ type: normalizedType, name: String(record.name) }),
-                                installedManifestsOfEngine(host.engine),
-                            )
+                            !host.isHostCodeDatasource(normalizedType, recordName)
+                            && !(perShipperType
+                                ? someShipperOf(host, normalizedType, recordName, servedOverrideOf)
+                                : servedOverrideOf(host.packagedArtifactOwner({ type: normalizedType, name: recordName })))
                         ) {
                             sealedOverlays.push({ type: normalizedType, name: String(record.name) });
                         }

packages/metadata-protocol/src/protocol-environment-rows.ts

@@ -264,6 +264,33 @@ export function shippingPackageIds(shipped: readonly unknown[]): ReadonlySet<str
     return shippers;
 }
 
+/**
+ * [ADR-0150 D4, #32552] Whether `judge` holds for SOME code package that ships
+ * `(type, name)`: the package the bare-name artifact lookup answers first (the
+ * one-holder answer, read alone while it holds), then every shipper
+ * ({@link shippingPackageIds} over `shippedArtifactsOf`).
+ *
+ * The question a pair's row asks of its base — is this row a declared
+ * override of the item, may this removal or restore treat it as one — when two
+ * namespaces' packages each ship the name (ADR-0150 D9): each holder has its
+ * own pair, so a row is judged against its own base, never against whichever
+ * shipper registered first. No shipper is picked: the row judged is the one
+ * its own `package_id` names. A name one package ships answers exactly as the
+ * bare lookup alone did.
+ */
+export function someShipperOf(
+    host: {
+        packagedArtifactOwner(request: { type: string; name: string }): string | undefined;
+        shippedArtifactsOf(type: string, name: string): unknown[];
+    },
+    type: string,
+    name: string,
+    judge: (basePackageId: string | undefined) => boolean,
+): boolean {
+    if (judge(host.packagedArtifactOwner({ type, name }))) return true;
+    return [...shippingPackageIds(host.shippedArtifactsOf(type, name))].some((shipper) => judge(shipper));
+}
+
 /**
  * [ADR-0146 D11] The READ-ONLY code packages that ship a name, sorted: the
  * {@link shippingPackageIds} of `shipped` less every package