[objectstack-fleet]

Requested by Elon · project thread

Fixes #32561

Clause-②: yes (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — skills/objectstack-platform/SKILL.md teaches the declared form (overrides: { package }) and an undeclared pair row only at a locale the base does not ship, the path the save door accepts; nothing in skills/** teaches the exact read of an undeclared pair row whose locale a later bundle addition also ships, or of a row beside another App's shared pair, the two reads this narrows (grep of skills/** for overrides.package, .custom, ?package= and email_template at head dd283faf40).

BREAKING (ADR-0087 registered, semantic entry pair-row-exact-read-no-owner): two exact reads of an undeclared row of an App's customization pair stop serving a row the registry binds to no package. First-party packages in either position: 0. Remedy the save door already accepts: declare the base with overrides.package.

维护者速读

• 改了什么：App 的定制配对（<app>.custom）里一条未声明基准包的行（没有 overrides.package），如果注册表判定它“不属于任何包”（因为同 App 的另一个包作为附加包也出货了同一个语言成员，或另一个 App 的共享配对也存了同名未声明行），按包精确读（?package=X）以前仍把它当 X 的定制返回；现在精确读采用注册表的判定，?package=X 只回答 X 自己出货的成员（没有就 404），?package=<app>.custom 仍能读到这条行。
• 为什么改：两个读取口对同一条行给出不同归属，精确读等于替作者猜了一个包（违反史诗红线 2：歧义要报告，不能猜）。新增一个只读公开方法 SchemaRegistry#overlayRowBinding，让精确读直接问注册表，不再自己另数一遍。
• 风险与回滚：收紧（narrowing，BREAKING，minor）。只影响“未声明 + 有歧义”的配对行，第一方包为 0；声明了 overrides.package 的行、单一归属的行、两个持有包可归属时的 409 都不变；一个持有包被禁用时，启用那个包的地址仍保有该行（R4-A 裁决）。回滚 = revert 本 PR。
• 先看：packages/metadata-protocol/src/protocol-exact-qualifier.ts 的 pairRowOnAddress 新增一行判定；packages/objectql/src/registry.ts 新增的 overlayRowBinding（只数被服务的持有包）；packages/objectql/src/package-scoped-exact-qualifier.test.ts 的 [#32561] 组。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/package-scoped-exact-qualifier.test.ts，预期全部通过；其中 [#32561] 组的 NARROWING（两种安装顺序 + 跨 App 配对）与 CONTROL（声明行、禁用一个持有包两种顺序）全绿。
• 需要你做的：无，席位落地。

What changes

The exact read's owner check (pairRowOnAddress, @objectstack/metadata-protocol) counted holders after the registry had bound the row: a bundle addition was no holder there, and another App's shared pair was never read. The registry (SchemaRegistry#pairRowBinding, since #32408 / PR #32815) counts an addition that ships the row's member as a second owner, and binds a row whose count would read another shared pair's undeclared row to no package. The two readers had no common answer (the card's divergence).

Now the exact read adopts the registry's binding instead of counting again:

• SchemaRegistry#overlayRowBinding(type, name, item) (new, public, read-only, packages/objectql/src/registry.ts): the binding overlaySlotBinding answers, counted over the served holders (a disabled package holds no name, ADR-0150 D3), in the order packageScopedHoldersOf counts the exact read's owner: the pair's owners are the served holders it customizes, and the bundle-addition rule is settled over every holder, the disabled ones left out afterwards, so a disable never promotes a dependent's addition to an owner (contract review M1). The holders are the ones packageScopedHoldersOf counts: every composite slot, then the package each bare-slot entry binds to, so a package holding the name only through its own stored row is an owner here too (contract review n1). The registry's own readers keep counting every holder, so a disable never moves their binding.
• pairRowOnAddress takes the binding lazily (registryBinding) and treats an undeclared pair row as not this address's member when its one owner is not the one the registry binds it to. Both callers (exactQualifierItem, pairMemberWithheldAt) pass it; a registry without overlayRowBinding keeps the exact read's own count.

Read (App A; X holds the email template; Z, on X, ships only fr-FR as an addition; A.custom stores an undeclared fr-FR row)	Before	Now
?package=X&member=fr-FR (Z installed before the row, or after it)	the row	X's own fr-FR: none, 404
X's list and execution list	carry the row	leave it out
?package=Z&member=fr-FR	Z's own fr-FR	unchanged
?package=A.custom&member=fr-FR	the row	unchanged
?package=Y / ?package=P when App A's pair and App B's pair each store an undeclared row of the name (registry binds neither)	the pair's row	the package's own item of that member (none)

Unchanged (CONTROL pins): a row declaring its base (overrides.package) binds and serves as declared; two holders that could own a row still refuse 409 naming both; a row whose one owner the registry binds it to is served as before; with one of two holders disabled, the enabled holder's address, list and execution list keep the undeclared row (residual (3), ruled C in 6837007729, keeping #32183 R4-A), re-enabled it is refused naming both; and the same when the disabled holder is the base of a bundle addition (Z on the App and on Y ships only fr-FR, Y disabled): Z stays an addition, X keeps the row; and when X holds the name only through its own stored row in the bare slot, X's address keeps the undeclared pair row as on main.

Files: protocol-exact-qualifier.ts, registry.ts, the pins in package-scoped-exact-qualifier.test.ts (and one comment line in package-scoped-resolver.test.ts), the semantic entry packages/spec/src/migrations/entries/semantic/18.pair-row-exact-read-no-owner.ts, and two changesets (metadata-protocol + objectql minor, BREAKING, adr-0087: registered; spec patch for the entry).

Tests

packages/objectql/src/package-scoped-exact-qualifier.test.ts, describe [#32561] …:

• NARROWING, residual 1: an undeclared row of the very locale a bundle addition of another package of the App ships, addition installed first; and the other order (row stored while X alone held the name, CONTROL that X served it, then Z installed). Each asserts the registry binds it to no package, ?package=X answers nothing, ?package=Z Z's own, ?package=A.custom the row, X's list and X's execution list leave it out (contract review S1), and X's own en-US stays X's.
• CONTROL: a row declaring X keeps X's address beside the addition.
• NARROWING, residual 2 (contract review F6 of metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408): two Apps' pairs each storing an undeclared row of the name; neither package address serves either row, each pair's own address does.
• CONTROL, residual 3, both registration orders: one of two holders disabled keeps the row on the enabled holder's address, list and execution list; re-enabled, refused naming both.
• CONTROL, contract review M1, both registration orders: X and Y ship en-US, Z (on the App and on Y) ships only fr-FR, an undeclared de-DE pair row, Y disabled: the owner count is [X], the adoption binds the row to X, ?package=X&member=de-DE serves it and both of X's lists keep it, Z keeps its own fr-FR; re-enabled, refused naming X and Y. Red on 72c8a9c8ef (2 failed / 249 passed in the file: AssertionError: the adoption counts as the exact read does: expected undefined to be 'com.acme.suitex'), green at 5a9d589a80.
• UNCHANGED, contract review n1, both registration orders (X's holding first, the pair row first): X holds the name only through its own stored row in the bare slot (a row with package_id X hydrated, no composite slot) and the App's pair stores an undeclared de-DE row: the adoption binds the row to X, ?package=X&member=de-DE serves it, X's own en-US stays X's. Red on 5a9d589a80 (2 failed: AssertionError: the adoption counts X as the exact read does: expected 'com.acme.suite.custom' to be 'com.acme.suitex'), green at dd283faf40. Beside it, the CONTROL with X's item in its composite slot, both orders, also pins X's list and execution list.

Ablations on head dd283faf40 (each through scripts/ablation-replace.mjs, landing proved, restored to the HEAD blob with git diff HEAD empty):

Ablation	Red / green of 375 (the two harness files)
A1: pairRowOnAddress's new line guarded off; metadata-protocol rebuilt, ablation-dist-preflight marker present in 2 built files (restore: rebuilt, absent from all 24)	3 / 372: the three NARROWING pins. AssertionError: `?package=X`: X ships no fr-FR: expected { name: 'welcome', …(6) } to be undefined
A2: overlayRowBinding keeps every holder, a disabled one included (registry.ts is imported relatively by the suite, no build)	7 / 368: the two residual-3 CONTROLs, the two M1 CONTROLs, the three #32183 / #32408 disable pins. AssertionError: the adoption counts the served holders: expected undefined to be 'com.acme.suitex'
A3: the addition rule settled over the served holders only (round 1's shape)	2 / 373: the two M1 CONTROLs. AssertionError: the adoption counts as the exact read does: expected undefined to be 'com.acme.suitex'
A4: the adoption counts composite slots only (round 1's holder set)	2 / 373: the two n1 pins. AssertionError: the adoption counts X as the exact read does: expected 'com.acme.suite.custom' to be 'com.acme.suitex'
restored	375 / 375

Acceptance notes

• This branch resumes claude/project-thread-04ua2f@c233053b1e and merges origin/main once (bf02d33bd, merge commit 72c8a9c8ef). The branch had carried PR fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32815's round-3 head; the four conflicts (objectql/src/registry.ts, the two package-scoped-* test files, 18.pair-row-locale-addition-refused.ts) each take main's landed copy (e336a33eb) with the card's own four commits replayed onto it, and the two 32408-* changesets stay deleted (consumed by version packages chore: version packages #29963). Measured: the card's +/- lines vs main equal the branch's delta over PR fix(objectql)!: every reader of the registry's overlay slot binds a row of an App's customization pair by the exact read's owner rule (ADR-0150 D4) #32815's head c3cc324b1 line for line, apart from main's own permission-set lines. The diff against main is the card's seven files only. Main's fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 (metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354) and fix(metadata-protocol)!: two packages' declared overrides of one flow or action name each serve in their own package's slot, in any registration order (ADR-0150 D4) #33126 (metadata-protocol: getMetaItemsForExecution files one pair package's bound flow override under another package's slot, by registration order (ADR-0150 D4, red line 2) #32613) are in the merged head; protocol-exact-qualifier.ts merged without conflict.
• Residual shape from the epic red-line read 6841098779 (card comment 6841146506): measured in 6863197549, main's and not moved here (W's exact address, list and execution list serve a row declared for X when X holds nothing, on main and at this head alike); the seat routes it.
• Contract review n1, answered: reachable with the harness double (X holding the name only through its own stored row in the bare slot), where round 1's adoption withheld the App's undeclared pair row at ?package=X while main served it. Fixed here (the adoption counts the holders as packageScopedHoldersOf does) and pinned; no second move to declare. Observed beside it and not moved: in that state X's list and execution list leave the row out, on main and at this head alike (the list door's own count), while X's exact address serves it; outside this card, left for the seat to route.
• The bare member read ignoring a declared pair override stays with the follow-up card (sub-issue of this card, blocked by it); this PR does not touch it.
• metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 shares protocol-exact-qualifier.ts and runs after this card lands.

Verification

All local readings on head dd283faf40 (round 2: 5a9d589a80 for M1 and S1, then dd283faf40 for n1; no commit after it).

Affected suites and typecheck

• pnpm --filter @objectstack/metadata-protocol test: Test Files 337 passed, 7 skipped (344); Tests 22803 passed, 36 skipped (22839). typecheck exit 0. Lock VERDICT command-exit 0.
• pnpm --filter @objectstack/objectql test: Test Files 595 passed (595); Tests 12843 passed (12843). typecheck exit 0. Lock VERDICT command-exit 0.
• Focused files (package-scoped-exact-qualifier.test.ts, package-scoped-resolver.test.ts): 375/375 (369 at 72c8a9c8ef, plus the two M1 CONTROLs and the four n1 pins).

dispatch-gates

node scripts/pm/dispatch-gates.mjs --commands derived the same 94 commands from the same 7 paths vs merge base bf02d33bd. All 94 exit 0 (check:dual-build-cjs-loads measured this round: the dogfood closure build gave it its prerequisite). check:type-check-debt first answered exit 3 PREREQUISITE NOT MET (its closure build never got the verify lock while the dogfood battery held it); re-run under the lock: exit 0, "0 ledger entr(ies) re-measured … none above its recorded number". dispatch-gates --ran: "94 derived famil(ies) accounted for — 94 run, 0 NOT-MEASURED".

node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0
node scripts/check-adr-0087-registration.mjs --self-test :: exit 0
node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-dev-prereqs.mjs --self-test :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-empty-changeset.mjs --base origin/main :: exit 0
node scripts/check-empty-changeset.mjs --self-test :: exit 0
node scripts/check-engine-split-ratio.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
node scripts/ci/prune-turbo-cache.mjs --self-test :: exit 0
node scripts/ci/snapshot-next.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0
node scripts/release-pending-publish.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm --filter @objectstack/spec run check:api-surface :: exit 0
pnpm --filter @objectstack/spec run check:authorable-surface :: exit 0
pnpm --filter @objectstack/spec run check:browser-reachable-entries :: exit 0
pnpm --filter @objectstack/spec run check:docs :: exit 0
pnpm --filter @objectstack/spec run check:dual-source-exports :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm --filter @objectstack/spec run check:empty-state :: exit 0
pnpm --filter @objectstack/spec run check:entry-nameability :: exit 0
pnpm --filter @objectstack/spec run check:error-code-provenance :: exit 0
pnpm --filter @objectstack/spec run check:export-origins :: exit 0
pnpm --filter @objectstack/spec run check:exported-any :: exit 0
pnpm --filter @objectstack/spec run check:liveness :: exit 0
pnpm --filter @objectstack/spec run check:llms-txt :: exit 0
pnpm --filter @objectstack/spec run check:skill-refs :: exit 0
pnpm --filter @objectstack/spec run check:spec-changes :: exit 0
pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0
pnpm --filter @objectstack/spec run check:upgrade-guide :: exit 0
pnpm --filter @objectstack/spec run check:variant-docs :: exit 0
pnpm check:adr-symbol-anchors :: exit 0
pnpm check:changeset-gate-self-tests :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:durability-log-level :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:error-status-conformance :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:init-service-contract :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:keyed-text-bounds :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:merge-driver :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:object-def-param-keys :: exit 0
pnpm check:objectql-double-limit :: exit 0
pnpm check:optional-error-sink :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:platform-object-tenancy-census :: exit 0
pnpm check:pm-prior-rulings :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:registry-log-declared :: exit 0
pnpm check:rest-log-declared :: exit 0
pnpm check:rest-log-spy-declared :: exit 0
pnpm check:role-word :: exit 0
pnpm check:settings-bind-window :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:spec-docblock-symbol-anchors :: exit 0
pnpm check:spec-parsed-alias :: exit 0
pnpm check:startup-registry-verdict :: exit 0
pnpm check:system-context-census :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:undeclared-dep-imports :: exit 0
pnpm check:vouch-for-reference-callers :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

Lint and dogfood

pnpm lint (eslint, whole repo) on dd283faf40: exit 0.

Full dogfood battery once on the final head dd283faf40 (Clause-②: yes (narrowing)): closure pnpm --filter '@objectstack/dogfood^...' build (lock VERDICT command-exit 0), then pnpm --filter @objectstack/dogfood test under the lock, no shard, no path: VERDICT command-exit 0 · Test Files 460 passed, 3 skipped (463) · Tests 3886 passed, 42 skipped (3928) · no failure. (Round 1's run on 72c8a9c8ef read the same counts.)

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/spec, touching 10 documentable anchor(s).

22 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 128b6571f476d4fae347d8f860b04b95927d2cce.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 174 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 128b6571f476d4fae347d8f860b04b95927d2cce → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0f011fc8af0d4fb34b9e7fa369858a14c1808aee — the merge of head dd283faf40257bc209debc3d3aa66e11345f7405 into base 128b6571f476d4fae347d8f860b04b95927d2cce, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0f011fc8af0d4fb34b9e7fa369858a14c1808aee && git checkout 0f011fc8af0d4fb34b9e7fa369858a14c1808aee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 128b6571f476d4fae347d8f860b04b95927d2cce dd283faf40257bc209debc3d3aa66e11345f7405 && git checkout -B drift-repro 128b6571f476d4fae347d8f860b04b95927d2cce && git merge --no-ff dd283faf40257bc209debc3d3aa66e11345f7405

node scripts/docs-audit/affected-docs.mjs --json 128b6571f476d4fae347d8f860b04b95927d2cce

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 128b6571f476d4fae347d8f860b04b95927d2cce → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 72c8a9c · 2026-11-13T19:43Z

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 72c8a9c8ef32cfa4f4a13df90a767cc11c30f2d8
Local-runs: none
Scope: .changeset/32561-exact-read-adopts-pair-row-binding.md, .changeset/32561-pair-row-exact-read-semantic-entry.md, packages/metadata-protocol/src/protocol-exact-qualifier.ts, packages/objectql/src/registry.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/objectql/src/package-scoped-resolver.test.ts, packages/spec/src/migrations/entries/semantic/18.pair-row-exact-read-no-owner.ts + read as cited code, not reviewed: packages/objectql/src/registry.ts outside the diff (overlaySlotBinding, pairRowBinding, settledPairRowBinding, ownersHoldingAName, packageScopedHoldersOf, isBundleAddition, disablePackage), packages/metadata-protocol/src/protocol-meta-list-reads.ts (the one call of pairMemberWithheldAt), the pin "a disabled base never promotes a dependent's bundle addition to a holder of the name" in packages/objectql/src/package-scoped-resolver.test.ts.

First-round review, read at 2026-11-13T19:52Z. Inputs: card #32561 and its thirteen comments, the PR title and body as they stand, the diff against the merge base bf02d33b (seven files, +260 −9), the check-runs on this head, the knock 6863087504. Claim 6863133279. Ruling 6837007729 (residual 3, option C) is read as the card's comments and the PR body quote it; its own text was not read here.

① Derived judgments

• The title, the body and the first changeset agree: fix(metadata-protocol)!:, Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, adr-0087: registered. The yes is the new public method SchemaRegistry#overlayRowBinding; the narrowing is the two exact reads and the lists scoped to a package.
• The second changeset carries the ledger entry alone and reads Clause-②: no, Metadata-protocol: none. Right: the entry adds no key and no export.
• The body has no Skills-docs: line. A kind other than none owes it, and so does a (narrowing) arm (M2).
• The declared FROM and TO is not the whole move. One disable shape the body lists under "Unchanged" moves too, by the reading in M1.

② Semver level

• minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec: right for a narrowed kind. The diff moves both packages, and objectql gains a public method.
• Check Changeset is green on this body.

③ Boundary flags

• Check-runs at the read: 64 runs, 34 concluded (none failed), 30 in progress, among them Build Core, the eight Test Core shards and three type checks. Not waited for: this verdict does not rest on them.
• Order. The merge base is bf02d33b; main is three commits past it (fix(mcp,storage): say which upload link a lock refuses; close the upload-link relay's code #33142, feat(lint): form layout, visibility and page-sort advisories carry a localized user sentence #33143, fix(runtime): MCP list_actions marks a confirmation-gated action unavailable for an AI service account #33144), none on a path of this diff. A git merge-tree of main and this head reports no conflict.
• Fixes #32561 closes a card with one open sub-issue (the bare member read that ignores a declared override), which this PR does not touch, as the body says. The seat's.
• The declared-row shape of card comment 6841146506 is measured by the dev in 6863197549 as main's and not moved here. The seat's to route.
• The epic red-line read is owed before ACCEPT, as the knock says.
• The ablations, the local runs and the dogfood battery are the report's; none was run here.

④ Design judgment

packages/metadata-protocol/src/protocol-exact-qualifier.ts. The adoption is one line of pairRowOnAddress, placed after the four older arms: a declared row, the App's own pair, two owners (refused), a sole owner outside the address's bases. So it can turn a served row into "not this address's member" and nothing else; it cannot serve what was refused or refuse what was withheld. The binding is read lazily and only for an undeclared row with exactly one served owner that is a base. Both callers pass it, so the exact read and the scoped list ask one question, and a registry without the method keeps the older count. This is the shape the card's ruling asks for.

packages/objectql/src/registry.ts, overlayRowBinding. The method hands overlaySlotBinding the composite holders less the disabled ones. That answers ruling C for the case the CONTROL pins (two holders, one disabled). It also changes when the bundle-addition rule is settled, and there the two counts part (M1).

packages/spec/src/migrations/entries/semantic/18.pair-row-exact-read-no-owner.ts. The printed fields carry no tracker id. The remedy is the one the save door already prescribes (overrides.package), and the acceptance criterion can be checked at the three addresses it names.

packages/objectql/src/package-scoped-exact-qualifier.test.ts. Residual 1 is pinned in both install orders, with the CONTROL that X served the row before the addition arrived. Residual 2 pins both Apps' package addresses and both pair addresses. The declared-row CONTROL and the disable CONTROL (both registration orders, re-enable refused naming both) can fail. The NARROWING pins read the list and not the execution list (S1).

Findings:

• M1 must-fix. The adoption counts a disabled holder's addition as an owner, so the enabled holder loses a row the body lists as kept. Read, not run. overlayRowBinding leaves the disabled holders out before the addition rule is settled: ownersHoldingAName judges isBundleAddition against a membersOf keyed by the served set. packageScopedHoldersOf, which the exact read takes its one owner from, settles the addition rule over every holder and leaves the disabled ones out afterwards, and package-scoped-resolver.test.ts pins that order. The counts part when the disabled holder is the base of an addition. In the names of the residual-3 CONTROL: X and Y each ship en-US, Z (on the App and on Y) ships only fr-FR, the pair stores an undeclared de-DE row, Y is disabled. The exact read counts [X]: Z is an addition to Y and stays one. The adoption counts the served composite holders X and Z; Y is absent from membersOf, so Z is an addition to nothing there and stays an owner beside X. Two owners bind the row to no package, and the new line answers not-member. ?package=X&member=de-DE then answers X's own de-DE (none) where main serves the row, and X's lists leave it out. Z ships no de-DE, so this is not the residual-1 narrowing, and with Y enabled the read refuses naming X and Y as before. Owed: a pin of this shape in both registration orders, and the count made to agree with it (the addition rule settled over every holder, the disabled owners left out after). If the seat reads the withholding as right instead, it owes a FROM and TO line and a ruling, since it narrows what ruling C kept. If the pin is green on this head as it stands, this reading is wrong and the finding falls.
• M2 must-fix, on the PR body. No Skills-docs: line. Metadata-protocol: narrowed owes one, written from the diff. A body edit; no push. A grep of skills/** at this head finds the declared form (overrides.package) taught and nothing on the exact read of an undeclared pair row, which the line's reason can say if the dev reads the same.
• S1 should-fix. The changeset and the body's table declare X's execution list among the narrowed reads. expectNoOwnersRow asserts listed(X) and never forSend(X); only the residual-3 CONTROL reads the execution list, on the keep side. One forSend(X) line in the helper pins the declared answer.
• n1 nit, a question; no change asked. The owner the exact read counts comes from packageScopedHoldersOf, which also counts a package that holds the name only through its own stored row in the bare slot. overlayRowBinding counts composite holders, so for such an owner it would answer the pair itself and the new line would withhold the row. Not traced to a reachable state here. If the seat knows one, it is a second move to declare; if none exists, nothing is owed.

Two must-fix. M1 needs a push, so the delta is this seat's on the new head; M2 can ride the same round.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head dd283fa · 2026-11-13T20:25Z

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Local-runs: none
Scope: packages/objectql/src/registry.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts (the interdiff), and the PR body's declaration lines + read as cited code, not reviewed: settledPairRowBinding, ownersHoldingAName, packageScopedHoldersOf and isBundleAddition in packages/objectql/src/registry.ts outside the interdiff; otherwise nothing beyond what record 6863299225 lists.

Delta review of FAIL 6863299225, read at 2026-11-13T20:48Z. Inputs: the interdiff 72c8a9c8..dd283faf (two commits of this branch on two files, no merge), the PR title and body as they stand, the check-runs on this head. Claim 6864020185. No knock asked for this round: the owed list showed the head moved under the record. Everything that record judged and the interdiff does not touch stands as read there.

① Derived judgments

• The changeset's declaration stands: Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, the ! title, adr-0087: registered. The interdiff adds no moved answer; it takes back the one M1 read.
• The body still has no Skills-docs: line (M2).

② Semver level

• Unchanged and right: minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec.

③ Boundary flags

• Check-runs on this head, all concluded: 67 runs, 56 success, 11 skipped, none failed. The eight Test Core shards and their roll-up, the type checks and Check Changeset are green.
• Order. The merge base is still bf02d33b; main is seven commits past it (fix(mcp,storage): say which upload link a lock refuses; close the upload-link relay's code #33142, feat(lint): form layout, visibility and page-sort advisories carry a localized user sentence #33143, fix(runtime): MCP list_actions marks a confirmation-gated action unavailable for an AI service account #33144, fix(lint)!: os validate and os build resolve a dashboard's dataset through the reader's declared closure, as the runtime does #33121, fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129, fix(lint): connector, permission-set and form-view advisories carry a user sentence in every platform locale #33145, fix(service-analytics): a truncated query_dataset answer carries drill sidecars for the served rows only #33146), none on a path of this diff. A git merge-tree of main and this head reports no conflict.
• The body's Tests and Verification sections are written for 72c8a9c8: they name neither the M1 CONTROL nor the n1 pins, and their counts are of 369 tests. The runs on this head are the report's; none was run here.
• Fixes #32561 and its open sub-issue, the declared-row shape of 6841146506, and the epic red-line read: as flagged in record 6863299225. The seat's.

④ Design judgment

packages/objectql/src/registry.ts, overlayRowBinding (M1). Fixed. For a row stamped with a package that holds no composite slot, the method now counts in two steps, in the order packageScopedHoldersOf uses. The pair's owners are the served holders it customizes. The bundle-addition rule is then settled by ownersHoldingAName over every composite holder, a disabled one included, so an addition to a disabled holder stays an addition and is no second owner. In the shape M1 named (X and Y ship en-US, Z on Y ships fr-FR, an undeclared de-DE row, Y disabled) the owners are X and Z, Z is dropped as an addition to Y, and the row binds to X. The first-round CONTROL (two holders, one disabled) and both residual-1 orders read the same as before under the new count.

The same method (n1). Answered, and it was a move. The holders are now the ones packageScopedHoldersOf counts: every composite slot, then the package a bare-slot entry binds to. A package that holds the name through its own stored row alone is an owner again, so its address keeps the App's undeclared pair row, as on main.

packages/objectql/src/package-scoped-exact-qualifier.test.ts. The M1 CONTROL runs both registration orders and asserts the two counts side by side (packageScopedHoldersOf answers X alone, overlayRowBinding answers X), then the address, the list, the execution list, Z's own member, and the refusal naming X and Y after the re-enable. The n1 pins run the bare-slot holding and its composite CONTROL in both registration orders. expectNoOwnersRow now reads the execution list too (S1).

One reading left with the seat, no change asked: ownersHoldingAName now reads the other pairs' rows over every holder as well, so a second App's undeclared row keeps this pair's row bound to no package while one of that App's two holders is disabled. That is residual 2 as declared (another App's shared pair stores an undeclared row of the name); a disable in the other App does not lift it.

Findings:

• M2 must-fix, open on the PR body, the only one left. No Skills-docs: line. Metadata-protocol: narrowed owes one, written from the diff. A body edit re-runs Check Changeset; no push is needed.

M1, S1 and n1 of record 6863299225 are closed on this head. Once the line is in the body and Check Changeset is green on this head, the PASS is this seat's without a new push.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Local-runs: none
Scope: the PR title and body as edited (no path of the diff changed; the head is the one record 6864576272 read) + read as cited code, not reviewed: skills/objectstack-platform/SKILL.md, content/docs/concepts/metadata-lifecycle.mdx, settledPairRowBinding in packages/objectql/src/registry.ts

Close-out of FAIL 6864576272, read at 2026-11-13T21:13Z. Inputs: the PR title and body as they stand after the body edit, the check-runs on this head, knock 6864947326. The head has not moved, so claim 6864020185 still names it. Everything records 6863299225 and 6864576272 judged on the diff stands as read there.

① Derived judgments

• The body now carries the third line: Skills-docs: none, with its reason (the skills teach the declared form and an added locale of the pair, nothing teaches the two reads this PR narrows). M2 is closed.
• The line is true by this seat's own reading. The platform skill (SKILL.md line 127) and the lifecycle page (the bullet "The pair's added locale is served on the base's address") both teach a base that is the App itself with its own pair. For that shape settledPairRowBinding answers the App before any count of members, so the binding the exact read adopts is the base, and the taught sentence is not moved. Both narrowed reads need a holder that is a package of an App and not the App itself; neither text teaches that shape. The reason in the body cites a grep of skills/** only; the docs page reads the same way.
• Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, the ! title and adr-0087: registered are unchanged by the edit and stand.

② Semver level

• Unchanged and right: minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec.

③ Boundary flags

• Check-runs on this head, all concluded: 71 runs, 58 success, 13 skipped, none failed. The four newest are the re-runs the body edit started at 21:07Z: Check Changeset success, the PR-body guards success, Auto Label and Check PR Size skipped. The 67 runs of the push read as in record 6864576272.
• Order. main is still at 702c562c, the commit record 6864576272 read: seven commits past the merge base bf02d33b, none on a path of this diff, no conflict reported by git merge-tree.
• The Tests and Verification sections are now written for this head (375 focused tests, the M1 CONTROL and n1 pins with their red readings, ablations A1 to A4, 94 of 94 gates, the dogfood battery). Those runs are the report's; none was run here.
• New in the Acceptance notes, for the seat to route: with X holding the name only through its own stored row, X's list and execution list leave the App's undeclared pair row out while X's exact address serves it, on main and at this head alike. Not moved by this PR and outside the card; it is a list and exact-read disagreement of the kind this card closes elsewhere.
• Fixes #32561 and its open sub-issue, the declared-row shape of 6841146506, and the epic red-line read: as flagged in record 6863299225. The seat's.

④ Design judgment

Nothing new to judge: no code moved. M1, S1 and n1 were closed on this head in record 6864576272, and the one reading left with the seat there (a second App's undeclared row keeps this pair's row bound to no package while one of that App's holders is disabled) stands as written.

Findings:

• None open. M2 is closed by the body edit; no should-fix or nit is carried.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

[objectstack-fleet]

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Epic red-line re-read · 2026-11-13T21:38Z

Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Verdict: PASS on the three red lines. Nothing is owed before ACCEPT. The two seat-routing observations are not red-line issues: (a) is a follow-up card, and (b) needs no card under ruling 6837007729.

This re-reads PR #33148 (card #32561, epic #31527, ADR-0150 D4), which declares Metadata-protocol: narrowed, against:

• review#1's records: FAIL 6863299225 on 72c8a9c8, delta 6864576272, PASS 6865065266 on this head;
• the os-dev report 6863103724;
• the dev measurement 6863197549.

Merge base bf02d33bd. origin/main at this read is 702c562c1f, 7 commits ahead. The diff against main is the card's 7 files only, and the merge is automatic. GitHub reports mergeable_state: clean. CI on the head has 71 check runs: 58 success, 13 skipped, 0 failed.

Everything below was measured on a scratch merge of this head with 702c562c1f (local merge commit d1a063d3a9, never pushed), unless a line says "read". The harness is the real SchemaRegistry and ObjectStackProtocolImplementation of package-scoped-exact-qualifier.test.ts.

(1) Resolution is never loosened: holds

The production change, read.

• packages/metadata-protocol/src/protocol-exact-qualifier.ts:
  • adds one optional method to ExactQualifierRegistry (overlayRowBinding?) and a lazy reader for it (registryRowBinding);
  • adds one argument at each of the two pairRowOnAddress callers (exactQualifierItem, pairMemberWithheldAt);
  • adds one new line in pairRowOnAddress: if (owners.length === 1 && registryBinding !== undefined && registryBinding() !== owners[0]) return 'not-member';.
• Where the new line sits: it is the last arm before return 'serve'. The declared-row arm, the App's own pair arm, the two-owner refusal and the non-base sole owner all return before it. It runs only when the sole owner is one of the address's bases, and it can only turn serve into not-member.
• What not-member leads to:
  • In exactQualifierItem, not-member falls through to the older S2 tail. That tail refuses when the address admitted two or more holders. Otherwise it answers the address holder's own getPackageScopedItem.
  • In pairMemberWithheldAt (protocol-meta-list-reads.ts:732, the list door scoped to a package), not-member withholds the row from that package's list.
• packages/objectql/src/registry.ts:
  • adds SchemaRegistry#overlayRowBinding, which is read-only;
  • the rest of its diff is comment text, so no existing registry reader changes;
  • overlayRowBinding has no production caller except the exact read's registryRowBinding.
• package-scoped-resolver.test.ts: one comment line.

Focused file. package-scoped-exact-qualifier.test.ts + package-scoped-resolver.test.ts: 375 / 375 passed.

Main's exact read on the same tree. I swapped in origin/main's protocol-exact-qualifier.ts, rebuilt metadata-protocol and kept the head's registry.ts. The only change there is the new, unused method. Result: 3 failed / 372 passed. The 3 are exactly the three NARROWING pins (residual 1 in both orders, residual 2). Each fails because main served the row:

• AssertionError: `?package=X`: X ships no fr-FR: expected { name: 'welcome', …(6) } to be undefined
• AssertionError: `?package=Y`: Y ships no es-ES: expected { name: 'welcome', …(6) } to be undefined

Logging probe over whole suites. The scratch probe logs every pairRowOnAddress call that reads the binding. For each move it records main's verdict (the same function without the new line) and the caller's final answer. It changes no answer.

• objectql, the whole suite: 596 / 596 files, 12868 / 12868 tests passed.
  • 42 binding reads. 34 bind the row to its sole owner, so the row is served as on main.
  • 8 moved, all serve → not-member. In every one the binding was "no package". It was never another package and never null.
  • 4 of the 8 are exact reads. Each went from "the pair row" to undefined (the holder ships no such member, so 404).
  • The other 4 are list or execution-list entries, now withheld.
  • overlayRowBinding threw 0 times. 0 moves in any other direction.
• metadata-protocol, the whole suite under the same probe: 337 passed / 7 skipped files; 22803 passed / 36 skipped tests. 0 binding reads, because its doubles carry no overlayRowBinding, so main's count applies there.

Scratch cases on both builds. I ran 17 scratch cases twice: once on the head, once on main's exact read.

• Faces read: plain exact read, layered read (getMetaItemLayered with packageId), list, and execution list.
• Shapes:
  • residual 1, both orders;
  • residual 2 in 4 registration and storage orders;
  • residual 2 with each holder of each App disabled in turn, in two shapes of App B;
  • observation (a), both orders.
• Result: 38 cells differ, and every one goes from "served or listed on main" to "no item or left out on the head". 0 cells move toward serving.
• The layered read at ?package=X&member=fr-FR moves too: overlay and effective go from pair fr-FR to null. This follows by construction, because the code layer at an exact address is judged as the plain read judges it (metadata-protocol: a package-less row of a two-holder name is still served at both exact addresses for package-scoped types outside PACKAGE_SCOPED_READ_TYPES (action first) (ADR-0150 D4) #32407). Nit, no change owed: the changeset's FROM → TO lines name the plain read and both lists, but not this layered face.

Bare names: the changed line runs only for exact-address callers (six exactQualifierItem call sites in the item and layered reads, each gated on exactAddress) and for the list scoped to a package. No bare read reaches it.

(2) Ambiguity is reported, never guessed: holds

• Every moved face goes toward no owner's row. X, Y and P each answer their own shipped item of the member (none, so 404) or leave the row out of their lists. The pair's own address keeps the row. No moved face picks a holder. The two-owner refusals are unchanged: in the P+P2 shape, ?package=P&member=fr-FR is 409 naming P and P2 on both builds.
• Order. The PR pins residual 1, residual 3, M1 and n1 in both orders. Residual 2's pin uses one order, so I ran three more on the head: A's row stored first; Y installed before U; and both. All three give the same cells as the pinned order (both bindings "no package", ?package=Y and ?package=P no item, each pair's own address serves its row). Residual 1 gives identical cells in both orders on the plain read, the layered read and both lists.
• No by-order path is left on the faces this PR moves. By-order paths nearby, older than this PR and not touched by it:
  • metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 (open, pm:blocked): the bare read of a name held only by stored rows of two enabled packages answers by save order, while /layers refuses. Its Blocked-by: #32354 is still open, although metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354's PR fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 merged at 2026-11-13T18:04:56Z. Seat bookkeeping.
  • metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 (open, pm:queue): the six sealed served-override types and the overlay list filter judge a declared override against the first shipper only.

(3) Every child is independently releasable: holds

• Blocked-by. metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 lists only metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408, closed 2026-11-13T03:14:02Z.
• Phase-1 one-holder pins: green. 10 files, 631 / 631 passed:
  • registry-bare-name-one-holder.test.ts and its ai, flow and request family files;
  • metadata-sync-flow-two-holders, registry-namespace-co-owner-names, hook-binder-package-scope, package-scoped-e8-readers, manifest-service-residual-namespace-name and protocol-flow-custom-override.
  • Plus the whole objectql and metadata-protocol suites above.
• Additive.
  • One optional interface method and one new read-only public method.
  • No stored shape, column, index or URL changes.
  • Registry readers are unchanged.
  • Bare names are unchanged, as in (1).
  • A registry without overlayRowBinding keeps the exact read's own count.
• ADR-0087. node scripts/check-adr-0087-registration.mjs --base origin/main --head HEAD exits 0 and prints: "1 declared-breaking changeset(s) … [BREAKING+bang+clause-②-narrowing+metadata-protocol-narrowed] registered pair-row-exact-read-no-owner (new here)".
  • --self-test exits 0. check-changeset-no-major --base origin/main exits 0.
  • The generated migration registry (588 semantic entries) contains pair-row-exact-read-no-owner.
  • The entry names no mechanical rewrite, so nothing guesses a row's base.
• Declarations (read). The changeset has minor on @objectstack/metadata-protocol and @objectstack/objectql and patch on @objectstack/spec, plus the **BREAKING** banner. The title is fix(metadata-protocol)!:. Body and changeset both carry Clause-②: yes (narrowing) and Metadata-protocol: narrowed. The changeset carries adr-0087: registered, and the body carries Skills-docs: none with its reason.

Seat-routing observations

• (a) X holds the name only through its own bare-slot stored row: follow-up, not a red-line issue. Measured in both orders, on both builds, with identical cells:
  • ?package=X&member=de-DE serves pair de-DE, and overlayRowBinding answers X.
  • X's list and execution list are ["suitex en-US"], without the row.
  • The exact read serves the row to its one owner, as main does, which is no guess. The lists serve less, not more.
  • This is a list-versus-exact-read disagreement: the list door does not count a package that holds only through its own stored row. It is older than this PR and not moved by it.
  • Route: a p3 follow-up card, or a checklist item on metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 like that card's item 4.
• (b) A second App's undeclared row keeps this pair's row bound to no package while one of that App's holders is disabled (residual 2): not a red-line issue, no card owed. Measured with each of App B's holders disabled in turn (P and Q in the P+Q shape, P and P2 in a P+P2 shape):
  • App A's row stays bound to no package, and ?package=Y&member=es-ES answers no item where main served pair es-ES.
  • Meanwhile the adoption binds App B's own row to B's enabled holder, which serves it, as on main.
  • Disabling one of App A's own holders instead (U or Y) binds A's row to the other A holder, which serves it, as on main (R4-A).
  • The move goes toward no owner and never picks. It sits inside the declared residual-2 line ("the registry binds neither"): the registry's own every-holder binding binds neither row in every case measured.
  • Unifying the disabled-state count across pairs is the family card that ruling 6837007729 already names, not this card.

Carried paths and their cards

• The declared-row shape of 6841146506, measured in 6863197549 as main's and not moved here: carried as metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 item 4 (open, pm:queue).
• metadata-protocol: the bare member read ignores a pair override declared for an addition package's own locale member #32849 (open, pm:blocked, sub-issue of metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561): the bare member read ignores a pair override declared for an addition's own locale member. Not touched by this PR, which carries Fixes #32561. After the merge it stays blocked by metadata-protocol: a pair row declared for package X is served at an addition package Z's exact address as Z's item, where the registry answers Z's own (ADR-0150 D4, red line 2) #32606.
• metadata-protocol: a pair row declared for package X is served at an addition package Z's exact address as Z's item, where the registry answers Z's own (ADR-0150 D4, red line 2) #32606 (open, labelled pm:queue and pm:blocking): a row declared for X is served at addition Z's exact address. Its body says Blocked-by: #32561, which this PR closes.
• metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 and metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131: the by-order paths in (2).
• Seen in passing. These read the same on main and at this head (harness double, not through the doors, not diagnosed), and none is by-order. The seat decides whether to measure them further:
  1. P+Q shape with P disabled: Q, an addition to the disabled P, serves App B's undeclared fr-FR row at ?package=Q, because no served holder pairs it, so the last arm serves it. overlayRowBinding answers Q too.
  2. Residual 2 with Y disabled: ?package=com.acme.suite.custom&member=es-ES answers no item. Meanwhile the disabled Y's list carries pair es-ES, and U's address serves it.
  3. Shape (a): ?package=Y&member=de-DE, where Y holds nothing, refuses 409 naming X and com.acme.suite.custom. The pair id is listed as a candidate package.

Scratch worktree /home/user/rl33148 was removed after this read. Nothing was pushed, and nothing was written to GitHub.

[objectstack-fleet]

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-13T21:39Z · head dd283faf40257bc209debc3d3aa66e11345f7405

Verdict: ACCEPT: Fixes #32561. Not governed, 7 files, +350 / −9 (check-governed-merges --pr 33148). This seat (the sole epic seat of #31527) lands it, per the maintainer's order to carry the epic's already-branched p2 cards to merge and the standing order that seats review and land with pm-dispatch.

席位核对

1. Shape: draft PR to main, Fixes #32561, ! title, Clause-②: yes (narrowing) / Metadata-protocol: narrowed, BREAKING banner, adr-0087: registered pair-row-exact-read-no-owner, Skills-docs: none with its reason.
2. Reviews: review#1 FAIL 6863299225 on 72c8a9c8 (M1, M2, S1, n1); delta FAIL 6864576272 on this head (M1, S1, n1 closed; M2 body-only); close-out PASS 6865065266 on this head after the body edit, no finding open.
3. Epic red lines: re-read PASS 6865563363 on this head merged with main 702c562c1f: every moved face goes from served to refused or left out (8 of 42 bindings moved in the full objectql suite, all toward no owner); phase-1 one-holder pins 631/631; check-adr-0087-registration exit 0.
4. Verification on this head (report on the PR body): focused 375/375; ablations A1–A4 red, restored 375/375; metadata-protocol 22803 passed and objectql 12843/12843, both typechecks 0; 94/94 gates exit 0; lint 0; full dogfood 3886 passed, 0 failed.
5. Gates on this head: 71 check-runs, 58 success, 13 skipped, none failed or pending. K = 8, mergeable_state: clean, no conflict with main.
6. Carried: metadata-protocol: the bare member read ignores a pair override declared for an addition package's own locale member #32849 (the open sub-issue, the bare member read) stays open and is not touched here. The declared-row shape of 6841146506 → metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 item 4. The list-versus-exact-read observation in the Acceptance notes (X holding the name only through its own stored row) is routed to triage by this seat. Residual 2 under a disable in another App is inside the declared move (ruling 6837007729).
7. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 closes.