fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) - #33129

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 45 documentable anchor(s).

13 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ai/actions-as-tools.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/ai/index.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/api/client-sdk.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/api/environment-routing.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/api/wire-format.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/concepts/architecture-overview.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/concepts/metadata-lifecycle.mdx (via getOverlayRepo (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/deployment/cloud-connection.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/deployment/publish-and-preview.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/deployment/single-project-mode.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/protocol/kernel/http-protocol.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/ui/actions.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/ui/forms.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))
• content/docs/releases/v17/17-7.mdx (via environmentId (literal, a string literal in deleteMetaItemUnaudited))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7af31ee30bd0a5bd032a800a43489dacacabc0cb && git checkout 7af31ee30bd0a5bd032a800a43489dacacabc0cb
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bf02d33bd64f496aa8166e1a235ef10977927947 d311b66322543204efbd2f4526559ffcae4bebb7 && git checkout -B drift-repro bf02d33bd64f496aa8166e1a235ef10977927947 && git merge --no-ff d311b66322543204efbd2f4526559ffcae4bebb7

node scripts/docs-audit/affected-docs.mjs --json bf02d33bd64f496aa8166e1a235ef10977927947

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs bf02d33bd64f496aa8166e1a235ef10977927947 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head c35a911 · 2026-11-13T16:14Z

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: TIER_DEFAULT
Head-sha: c35a911b3073eafa6d152e2101a566322cd5c4a0
Local-runs: none

First round on the declaration face (Clause-②: yes (widening); no published schema, no governed path, no narrowing arm), read at 2026-11-13T16:42Z. Inputs: card #32552, the PR body, the diff against merge base 2c98485d (five files), the check-runs on this head, the knock 6858183179. Claim 6858479168. Read for the judgments below, not reviewed as a design: someShipperOf and its three call sites, and the [#32552] pins.

① Derived judgments

• Clause-②: yes (widening) is right. Two doors admit a request they refused: the removal naming the second holder's pair goes from 403 NOT_OVERRIDABLE to 200, and a commit revert into that pair goes from failed[] to restored. Nothing that was admitted is refused.
• Metadata-protocol: none is right: nothing an author can write is added, refused or given a new meaning.
• The one-holder answer does not move. someShipperOf asks the bare-name owner first, and with one shipper the set it walks next holds that same package.
• No shipper is picked. Each call judges the row or the pair the request itself names, and asks only whether it is a pair of some package that ships the name. A pair of no shipper keeps its 403 and stays in the census (pinned in both orders).
• The census row is true on this base for a flow only (s1).

② Semver level

• patch on @objectstack/metadata-protocol follows from none. A widening carries no BREAKING banner and no !, and none is written. No ADR-0087 marker is owed.

③ Boundary flags

• Check-runs on this head, all concluded: 51 runs, 35 success, 16 skipped, none failed.
• Order. The card and the PR put this after metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613, whose PR fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 holds FAIL 6858448985 on c0b7cb13. This head's base does not carry that fix. The trial merge against it is named in the PR as the seat's step before queueing; both PRs add a describe to packages/objectql/src/protocol-flow-custom-override.test.ts.
• The census overlaps metadata-protocol: the boot census reports a second holder's served declared override as unserved and prescribes deleting the stored row #32859, as the PR says. The seat's.
• The full dogfood battery was still running when the PR opened; its line goes to the os-dev report on the card. Not owed by the declaration (no !, no narrowing arm). Not read here.
• check:dual-build-cjs-loads is reported NOT MEASURED locally and left to CI.
• 92 commits on the branch, from the earlier branches it resumes; the diff against main is the five files.

Findings:

• s1 should-fix. The census sentence is true for a flow on this base, and for the other sealed types only after fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126. Derived from the code, not run. The census now leaves out a row that is the declared override of any shipper, for every type. On main the reads serve a second holder's declared override for a flow (every shipper since objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696), but for an action, a page, an app, a dataset, a doc, a book and a mapping they still judge the row against the first-registered holder and decline it; fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 is the change that moves them. So landed ahead of fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126, the census would stop naming a second holder's action override that the reads do not serve, which is the opposite of what the table's "live declared override" says. The census pin here boots both holders with a flow and an action override and expects an empty census, so it holds that silence too. Owed: land after fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126, as planned, and keep the census in step with whatever fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 ends up serving (its M1 may leave the six sealed types on the first-holder judgment, and then the census must keep naming them); say in the table that the census row is the flow's on main and the action's with metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613.
• n1 nit. "any open override type" on the removal row: the pins remove a flow, and an action in the condition-1 probe. The revert and the census are pinned on a flow.

No must-fix.

Implemented-by: session_016WV4cyN75XjF6J8fLtD21r
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head d311b66 · 2026-11-13T19:15Z

Delta of PASS 6859128505 on the moved head.

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d311b66322543204efbd2f4526559ffcae4bebb7
Local-runs: none
Scope: packages/metadata-protocol/src/protocol-diff-delete-load.ts, packages/objectql/src/protocol-flow-custom-override.test.ts, packages/metadata-protocol/src/protocol-environment-rows.ts, packages/metadata-protocol/src/protocol-class-head.ts, .changeset/32552-pair-row-removal-every-shipper.md (its declaration lines and level) + read as cited code, not reviewed: the census block of packages/metadata-protocol/src/protocol-diff-delete-load.ts on main, declinesStoredRow in packages/metadata-protocol/src/protocol-lock-state.ts as #33126 landed it.

Delta review of PASS 6859128505, read at 2026-11-13T19:42Z. Inputs: the interdiff c35a911b..d311b663 (one merge of main with no conflict, and one commit of this branch on three files), the PR title and body as they stand, the check-runs on this head, the knock 6862521648. Claim 6862544400. protocol-environment-rows.ts and protocol-class-head.ts are unchanged since c35a911b, and what the earlier record judged in them stands as read there.

① Derived judgments

• Clause-②: yes (widening) and Metadata-protocol: none stand. The commit takes a widening back for six types and adds none: the census moves for a flow and an action only.
• The census now asks the question the reads ask. For a flow and an action it judges the row against every shipper, as declinesStoredRow does since fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126. For any other type it is the expression main has, the name's first-registered shipper alone, so nothing moves there.
• The removal and the revert still judge every shipper for every type. That is consistent with the census: for a sealed type the second holder's override is a row the reads decline and the census names for deletion, and the removal that deletes it is now admitted where it was refused.

② Semver level

• patch on @objectstack/metadata-protocol, no BREAKING banner, no !, no ADR-0087 marker: unchanged, and right for a widening of kind none.

③ Boundary flags

• Check-runs on this head, all concluded: 55 runs, 37 success, 18 skipped, none failed. The eight Test Core shards, the type checks and Check Changeset are green.
• Order. fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 and fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 are on main and in this head; the merge base is bf02d33b, and main is two commits past it, none on a path of this diff. Both PRs added a describe to packages/objectql/src/protocol-flow-custom-override.test.ts; the merge kept both, and the file's run in CI is the reading of that.
• The census overlaps metadata-protocol: the boot census reports a second holder's served declared override as unserved and prescribes deleting the stored row #32859, as the PR says. The seat's.
• The full dogfood battery was read on c35a911b and not re-run for this delta; not owed by the declaration (no !, no narrowing arm). The ablation legs and local runs are the report's; none was run here.

④ Design judgment

packages/metadata-protocol/src/protocol-diff-delete-load.ts (s1). Fixed. perShipperType is flow or action by the canonical type; the two arms share one predicate call, so only the base it is judged against differs. The comment says why and names the card that moves the six. The new CONTROL boots two holders that each ship a mapping, stores each holder's declared mapping override, and expects the census to name exactly one row in both registration orders. By the report's ablation it goes red when the type restriction is removed, so it holds the line s1 asked for.

.changeset/32552-pair-row-removal-every-shipper.md and the PR table (s1, n1). The census row reads "a flow or an action only", a paragraph says what the six sealed types keep and until when, and each row names what it is pinned on.

Findings:

• None on this delta.

No must-fix. s1 and n1 of record 6859128505 are closed on this head. The census line carries a type and a name and no package, so mapping×1 over two stored rows is as far as the CONTROL can pin which row is named.

Implemented-by: session_016WV4cyN75XjF6J8fLtD21r
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-13T19:43Z · head d311b66322543204efbd2f4526559ffcae4bebb7

Verdict: ACCEPT: Fixes #32552. Not governed, 5 files, +400 / −16 (check-governed-merges --pr 33129). This seat (the sole epic seat of #31527) lands it, per the maintainer's order to carry the epic's already-branched p2 cards to merge and the standing order that seats review and land with pm-dispatch.

席位核对

1. Shape: draft PR to main, Fixes #32552, Clause-②: yes (widening) / Metadata-protocol: none per ruling 6819293900 cond. 2; files inside the re-posted claim 6855957599 (which corrects the seat's first claim lines).
2. Reviews: review#1 PASS 6859128505 on c35a911b (s1: land after fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 and keep the census in step with its scope; n1 wording); delta PASS 6863098475 on this head, no findings, s1 and n1 closed.
3. Order: fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 (metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613) merged first (840372560a), as s1 asked. This head merged main once after it (ae11537e, no conflict); the census now judges every shipper for flow and action only, and the six sealed types keep the first-registered shipper, matching declinesStoredRow, until metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131. A mapping CONTROL (both orders) pins that.
4. Verification on this head (report on the card): ablation leg A (type restriction removed) red on exactly the two mapping CONTROLs, leg B (fix reverted) 12 of 45 red, restore 45/45; metadata-protocol and objectql suites green, both typechecks 0; dispatch-gates 69/69 with dual-build-cjs-loads measured, 0 NOT-MEASURED; eslint 0. The full dogfood battery was green on round 1 (c35a911b); this round moves only the census in metadata-protocol plus main's merge, and the merge queue runs the full suite on the merged tree.
5. Gates on this head: 37 check-runs success, 18 skipped, none failed or pending. K = 2, mergeable_state: clean.
6. Carried: metadata-protocol: the boot census reports a second holder's served declared override as unserved and prescribes deleting the stored row #32859's census half is the third row this PR moves; its remainder is judged after landing. The six sealed types → metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131.
7. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that metadata-protocol: removing the second holder's .custom override of a shared name judges the pair row against a bare-name owner lookup, so it may depend on registration order (ADR-0150 D4) #32552 closes.