fix(metadata-protocol)!: the exact read no longer serves an undeclared App-pair row the registry binds to no package; it adopts SchemaRegistry#overlayRowBinding over the served holders (ADR-0150 D4) - #33148

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/spec, touching 10 documentable anchor(s).

22 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 128b6571f476d4fae347d8f860b04b95927d2cce.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0f011fc8af0d4fb34b9e7fa369858a14c1808aee && git checkout 0f011fc8af0d4fb34b9e7fa369858a14c1808aee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 128b6571f476d4fae347d8f860b04b95927d2cce dd283faf40257bc209debc3d3aa66e11345f7405 && git checkout -B drift-repro 128b6571f476d4fae347d8f860b04b95927d2cce && git merge --no-ff dd283faf40257bc209debc3d3aa66e11345f7405

node scripts/docs-audit/affected-docs.mjs --json 128b6571f476d4fae347d8f860b04b95927d2cce

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 128b6571f476d4fae347d8f860b04b95927d2cce → pass the list as
args.docs, on the commit named under Which tree this was computed on.

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 72c8a9c · 2026-11-13T19:43Z

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 72c8a9c8ef32cfa4f4a13df90a767cc11c30f2d8
Local-runs: none
Scope: .changeset/32561-exact-read-adopts-pair-row-binding.md, .changeset/32561-pair-row-exact-read-semantic-entry.md, packages/metadata-protocol/src/protocol-exact-qualifier.ts, packages/objectql/src/registry.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts, packages/objectql/src/package-scoped-resolver.test.ts, packages/spec/src/migrations/entries/semantic/18.pair-row-exact-read-no-owner.ts + read as cited code, not reviewed: packages/objectql/src/registry.ts outside the diff (overlaySlotBinding, pairRowBinding, settledPairRowBinding, ownersHoldingAName, packageScopedHoldersOf, isBundleAddition, disablePackage), packages/metadata-protocol/src/protocol-meta-list-reads.ts (the one call of pairMemberWithheldAt), the pin "a disabled base never promotes a dependent's bundle addition to a holder of the name" in packages/objectql/src/package-scoped-resolver.test.ts.

First-round review, read at 2026-11-13T19:52Z. Inputs: card #32561 and its thirteen comments, the PR title and body as they stand, the diff against the merge base bf02d33b (seven files, +260 −9), the check-runs on this head, the knock 6863087504. Claim 6863133279. Ruling 6837007729 (residual 3, option C) is read as the card's comments and the PR body quote it; its own text was not read here.

① Derived judgments

• The title, the body and the first changeset agree: fix(metadata-protocol)!:, Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, adr-0087: registered. The yes is the new public method SchemaRegistry#overlayRowBinding; the narrowing is the two exact reads and the lists scoped to a package.
• The second changeset carries the ledger entry alone and reads Clause-②: no, Metadata-protocol: none. Right: the entry adds no key and no export.
• The body has no Skills-docs: line. A kind other than none owes it, and so does a (narrowing) arm (M2).
• The declared FROM and TO is not the whole move. One disable shape the body lists under "Unchanged" moves too, by the reading in M1.

② Semver level

• minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec: right for a narrowed kind. The diff moves both packages, and objectql gains a public method.
• Check Changeset is green on this body.

③ Boundary flags

• Check-runs at the read: 64 runs, 34 concluded (none failed), 30 in progress, among them Build Core, the eight Test Core shards and three type checks. Not waited for: this verdict does not rest on them.
• Order. The merge base is bf02d33b; main is three commits past it (fix(mcp,storage): say which upload link a lock refuses; close the upload-link relay's code #33142, feat(lint): form layout, visibility and page-sort advisories carry a localized user sentence #33143, fix(runtime): MCP list_actions marks a confirmation-gated action unavailable for an AI service account #33144), none on a path of this diff. A git merge-tree of main and this head reports no conflict.
• Fixes #32561 closes a card with one open sub-issue (the bare member read that ignores a declared override), which this PR does not touch, as the body says. The seat's.
• The declared-row shape of card comment 6841146506 is measured by the dev in 6863197549 as main's and not moved here. The seat's to route.
• The epic red-line read is owed before ACCEPT, as the knock says.
• The ablations, the local runs and the dogfood battery are the report's; none was run here.

④ Design judgment

packages/metadata-protocol/src/protocol-exact-qualifier.ts. The adoption is one line of pairRowOnAddress, placed after the four older arms: a declared row, the App's own pair, two owners (refused), a sole owner outside the address's bases. So it can turn a served row into "not this address's member" and nothing else; it cannot serve what was refused or refuse what was withheld. The binding is read lazily and only for an undeclared row with exactly one served owner that is a base. Both callers pass it, so the exact read and the scoped list ask one question, and a registry without the method keeps the older count. This is the shape the card's ruling asks for.

packages/objectql/src/registry.ts, overlayRowBinding. The method hands overlaySlotBinding the composite holders less the disabled ones. That answers ruling C for the case the CONTROL pins (two holders, one disabled). It also changes when the bundle-addition rule is settled, and there the two counts part (M1).

packages/spec/src/migrations/entries/semantic/18.pair-row-exact-read-no-owner.ts. The printed fields carry no tracker id. The remedy is the one the save door already prescribes (overrides.package), and the acceptance criterion can be checked at the three addresses it names.

packages/objectql/src/package-scoped-exact-qualifier.test.ts. Residual 1 is pinned in both install orders, with the CONTROL that X served the row before the addition arrived. Residual 2 pins both Apps' package addresses and both pair addresses. The declared-row CONTROL and the disable CONTROL (both registration orders, re-enable refused naming both) can fail. The NARROWING pins read the list and not the execution list (S1).

Findings:

• M1 must-fix. The adoption counts a disabled holder's addition as an owner, so the enabled holder loses a row the body lists as kept. Read, not run. overlayRowBinding leaves the disabled holders out before the addition rule is settled: ownersHoldingAName judges isBundleAddition against a membersOf keyed by the served set. packageScopedHoldersOf, which the exact read takes its one owner from, settles the addition rule over every holder and leaves the disabled ones out afterwards, and package-scoped-resolver.test.ts pins that order. The counts part when the disabled holder is the base of an addition. In the names of the residual-3 CONTROL: X and Y each ship en-US, Z (on the App and on Y) ships only fr-FR, the pair stores an undeclared de-DE row, Y is disabled. The exact read counts [X]: Z is an addition to Y and stays one. The adoption counts the served composite holders X and Z; Y is absent from membersOf, so Z is an addition to nothing there and stays an owner beside X. Two owners bind the row to no package, and the new line answers not-member. ?package=X&member=de-DE then answers X's own de-DE (none) where main serves the row, and X's lists leave it out. Z ships no de-DE, so this is not the residual-1 narrowing, and with Y enabled the read refuses naming X and Y as before. Owed: a pin of this shape in both registration orders, and the count made to agree with it (the addition rule settled over every holder, the disabled owners left out after). If the seat reads the withholding as right instead, it owes a FROM and TO line and a ruling, since it narrows what ruling C kept. If the pin is green on this head as it stands, this reading is wrong and the finding falls.
• M2 must-fix, on the PR body. No Skills-docs: line. Metadata-protocol: narrowed owes one, written from the diff. A body edit; no push. A grep of skills/** at this head finds the declared form (overrides.package) taught and nothing on the exact read of an undeclared pair row, which the line's reason can say if the dev reads the same.
• S1 should-fix. The changeset and the body's table declare X's execution list among the narrowed reads. expectNoOwnersRow asserts listed(X) and never forSend(X); only the residual-3 CONTROL reads the execution list, on the keep side. One forSend(X) line in the helper pins the declared answer.
• n1 nit, a question; no change asked. The owner the exact read counts comes from packageScopedHoldersOf, which also counts a package that holds the name only through its own stored row in the bare slot. overlayRowBinding counts composite holders, so for such an owner it would answer the pair itself and the new line would withhold the row. Not traced to a reachable state here. If the seat knows one, it is a second move to declare; if none exists, nothing is owed.

Two must-fix. M1 needs a push, so the delta is this seat's on the new head; M2 can ride the same round.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head dd283fa · 2026-11-13T20:25Z

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Local-runs: none
Scope: packages/objectql/src/registry.ts, packages/objectql/src/package-scoped-exact-qualifier.test.ts (the interdiff), and the PR body's declaration lines + read as cited code, not reviewed: settledPairRowBinding, ownersHoldingAName, packageScopedHoldersOf and isBundleAddition in packages/objectql/src/registry.ts outside the interdiff; otherwise nothing beyond what record 6863299225 lists.

Delta review of FAIL 6863299225, read at 2026-11-13T20:48Z. Inputs: the interdiff 72c8a9c8..dd283faf (two commits of this branch on two files, no merge), the PR title and body as they stand, the check-runs on this head. Claim 6864020185. No knock asked for this round: the owed list showed the head moved under the record. Everything that record judged and the interdiff does not touch stands as read there.

① Derived judgments

• The changeset's declaration stands: Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, the ! title, adr-0087: registered. The interdiff adds no moved answer; it takes back the one M1 read.
• The body still has no Skills-docs: line (M2).

② Semver level

• Unchanged and right: minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec.

③ Boundary flags

• Check-runs on this head, all concluded: 67 runs, 56 success, 11 skipped, none failed. The eight Test Core shards and their roll-up, the type checks and Check Changeset are green.
• Order. The merge base is still bf02d33b; main is seven commits past it (fix(mcp,storage): say which upload link a lock refuses; close the upload-link relay's code #33142, feat(lint): form layout, visibility and page-sort advisories carry a localized user sentence #33143, fix(runtime): MCP list_actions marks a confirmation-gated action unavailable for an AI service account #33144, fix(lint)!: os validate and os build resolve a dashboard's dataset through the reader's declared closure, as the runtime does #33121, fix(metadata-protocol): a customization pair's row of a name two namespaces hold is judged against its own base, whichever package registered first (ADR-0150 D4) #33129, fix(lint): connector, permission-set and form-view advisories carry a user sentence in every platform locale #33145, fix(service-analytics): a truncated query_dataset answer carries drill sidecars for the served rows only #33146), none on a path of this diff. A git merge-tree of main and this head reports no conflict.
• The body's Tests and Verification sections are written for 72c8a9c8: they name neither the M1 CONTROL nor the n1 pins, and their counts are of 369 tests. The runs on this head are the report's; none was run here.
• Fixes #32561 and its open sub-issue, the declared-row shape of 6841146506, and the epic red-line read: as flagged in record 6863299225. The seat's.

④ Design judgment

packages/objectql/src/registry.ts, overlayRowBinding (M1). Fixed. For a row stamped with a package that holds no composite slot, the method now counts in two steps, in the order packageScopedHoldersOf uses. The pair's owners are the served holders it customizes. The bundle-addition rule is then settled by ownersHoldingAName over every composite holder, a disabled one included, so an addition to a disabled holder stays an addition and is no second owner. In the shape M1 named (X and Y ship en-US, Z on Y ships fr-FR, an undeclared de-DE row, Y disabled) the owners are X and Z, Z is dropped as an addition to Y, and the row binds to X. The first-round CONTROL (two holders, one disabled) and both residual-1 orders read the same as before under the new count.

The same method (n1). Answered, and it was a move. The holders are now the ones packageScopedHoldersOf counts: every composite slot, then the package a bare-slot entry binds to. A package that holds the name through its own stored row alone is an owner again, so its address keeps the App's undeclared pair row, as on main.

packages/objectql/src/package-scoped-exact-qualifier.test.ts. The M1 CONTROL runs both registration orders and asserts the two counts side by side (packageScopedHoldersOf answers X alone, overlayRowBinding answers X), then the address, the list, the execution list, Z's own member, and the refusal naming X and Y after the re-enable. The n1 pins run the bare-slot holding and its composite CONTROL in both registration orders. expectNoOwnersRow now reads the execution list too (S1).

One reading left with the seat, no change asked: ownersHoldingAName now reads the other pairs' rows over every holder as well, so a second App's undeclared row keeps this pair's row bound to no package while one of that App's two holders is disabled. That is residual 2 as declared (another App's shared pair stores an undeclared row of the name); a disable in the other App does not lift it.

Findings:

• M2 must-fix, open on the PR body, the only one left. No Skills-docs: line. Metadata-protocol: narrowed owes one, written from the diff. A body edit re-runs Check Changeset; no push is needed.

M1, S1 and n1 of record 6863299225 are closed on this head. Once the line is in the body and Check Changeset is green on this head, the PASS is this seat's without a new push.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Local-runs: none
Scope: the PR title and body as edited (no path of the diff changed; the head is the one record 6864576272 read) + read as cited code, not reviewed: skills/objectstack-platform/SKILL.md, content/docs/concepts/metadata-lifecycle.mdx, settledPairRowBinding in packages/objectql/src/registry.ts

Close-out of FAIL 6864576272, read at 2026-11-13T21:13Z. Inputs: the PR title and body as they stand after the body edit, the check-runs on this head, knock 6864947326. The head has not moved, so claim 6864020185 still names it. Everything records 6863299225 and 6864576272 judged on the diff stands as read there.

① Derived judgments

• The body now carries the third line: Skills-docs: none, with its reason (the skills teach the declared form and an added locale of the pair, nothing teaches the two reads this PR narrows). M2 is closed.
• The line is true by this seat's own reading. The platform skill (SKILL.md line 127) and the lifecycle page (the bullet "The pair's added locale is served on the base's address") both teach a base that is the App itself with its own pair. For that shape settledPairRowBinding answers the App before any count of members, so the binding the exact read adopts is the base, and the taught sentence is not moved. Both narrowed reads need a holder that is a package of an App and not the App itself; neither text teaches that shape. The reason in the body cites a grep of skills/** only; the docs page reads the same way.
• Clause-②: yes (narrowing), Metadata-protocol: narrowed, the BREAKING banner, the ! title and adr-0087: registered are unchanged by the edit and stand.

② Semver level

• Unchanged and right: minor on @objectstack/metadata-protocol and @objectstack/objectql, patch on @objectstack/spec.

③ Boundary flags

• Check-runs on this head, all concluded: 71 runs, 58 success, 13 skipped, none failed. The four newest are the re-runs the body edit started at 21:07Z: Check Changeset success, the PR-body guards success, Auto Label and Check PR Size skipped. The 67 runs of the push read as in record 6864576272.
• Order. main is still at 702c562c, the commit record 6864576272 read: seven commits past the merge base bf02d33b, none on a path of this diff, no conflict reported by git merge-tree.
• The Tests and Verification sections are now written for this head (375 focused tests, the M1 CONTROL and n1 pins with their red readings, ablations A1 to A4, 94 of 94 gates, the dogfood battery). Those runs are the report's; none was run here.
• New in the Acceptance notes, for the seat to route: with X holding the name only through its own stored row, X's list and execution list leave the App's undeclared pair row out while X's exact address serves it, on main and at this head alike. Not moved by this PR and outside the card; it is a list and exact-read disagreement of the kind this card closes elsewhere.
• Fixes #32561 and its open sub-issue, the declared-row shape of 6841146506, and the epic red-line read: as flagged in record 6863299225. The seat's.

④ Design judgment

Nothing new to judge: no code moved. M1, S1 and n1 were closed on this head in record 6864576272, and the one reading left with the seat there (a second App's undeclared row keeps this pair's row bound to no package while one of that App's holders is disabled) stands as written.

Findings:

• None open. M2 is closed by the body edit; no should-fix or nit is carried.

Implemented-by: session_016WV4cwzajrQVjjx4Dh1CA5
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Epic red-line re-read · 2026-11-13T21:38Z

Head-sha: dd283faf40257bc209debc3d3aa66e11345f7405
Verdict: PASS on the three red lines. Nothing is owed before ACCEPT. The two seat-routing observations are not red-line issues: (a) is a follow-up card, and (b) needs no card under ruling 6837007729.

This re-reads PR #33148 (card #32561, epic #31527, ADR-0150 D4), which declares Metadata-protocol: narrowed, against:

• review#1's records: FAIL 6863299225 on 72c8a9c8, delta 6864576272, PASS 6865065266 on this head;
• the os-dev report 6863103724;
• the dev measurement 6863197549.

Merge base bf02d33bd. origin/main at this read is 702c562c1f, 7 commits ahead. The diff against main is the card's 7 files only, and the merge is automatic. GitHub reports mergeable_state: clean. CI on the head has 71 check runs: 58 success, 13 skipped, 0 failed.

Everything below was measured on a scratch merge of this head with 702c562c1f (local merge commit d1a063d3a9, never pushed), unless a line says "read". The harness is the real SchemaRegistry and ObjectStackProtocolImplementation of package-scoped-exact-qualifier.test.ts.

(1) Resolution is never loosened: holds

The production change, read.

• packages/metadata-protocol/src/protocol-exact-qualifier.ts:
  • adds one optional method to ExactQualifierRegistry (overlayRowBinding?) and a lazy reader for it (registryRowBinding);
  • adds one argument at each of the two pairRowOnAddress callers (exactQualifierItem, pairMemberWithheldAt);
  • adds one new line in pairRowOnAddress: if (owners.length === 1 && registryBinding !== undefined && registryBinding() !== owners[0]) return 'not-member';.
• Where the new line sits: it is the last arm before return 'serve'. The declared-row arm, the App's own pair arm, the two-owner refusal and the non-base sole owner all return before it. It runs only when the sole owner is one of the address's bases, and it can only turn serve into not-member.
• What not-member leads to:
  • In exactQualifierItem, not-member falls through to the older S2 tail. That tail refuses when the address admitted two or more holders. Otherwise it answers the address holder's own getPackageScopedItem.
  • In pairMemberWithheldAt (protocol-meta-list-reads.ts:732, the list door scoped to a package), not-member withholds the row from that package's list.
• packages/objectql/src/registry.ts:
  • adds SchemaRegistry#overlayRowBinding, which is read-only;
  • the rest of its diff is comment text, so no existing registry reader changes;
  • overlayRowBinding has no production caller except the exact read's registryRowBinding.
• package-scoped-resolver.test.ts: one comment line.

Focused file. package-scoped-exact-qualifier.test.ts + package-scoped-resolver.test.ts: 375 / 375 passed.

Main's exact read on the same tree. I swapped in origin/main's protocol-exact-qualifier.ts, rebuilt metadata-protocol and kept the head's registry.ts. The only change there is the new, unused method. Result: 3 failed / 372 passed. The 3 are exactly the three NARROWING pins (residual 1 in both orders, residual 2). Each fails because main served the row:

• AssertionError: `?package=X`: X ships no fr-FR: expected { name: 'welcome', …(6) } to be undefined
• AssertionError: `?package=Y`: Y ships no es-ES: expected { name: 'welcome', …(6) } to be undefined

Logging probe over whole suites. The scratch probe logs every pairRowOnAddress call that reads the binding. For each move it records main's verdict (the same function without the new line) and the caller's final answer. It changes no answer.

• objectql, the whole suite: 596 / 596 files, 12868 / 12868 tests passed.
  • 42 binding reads. 34 bind the row to its sole owner, so the row is served as on main.
  • 8 moved, all serve → not-member. In every one the binding was "no package". It was never another package and never null.
  • 4 of the 8 are exact reads. Each went from "the pair row" to undefined (the holder ships no such member, so 404).
  • The other 4 are list or execution-list entries, now withheld.
  • overlayRowBinding threw 0 times. 0 moves in any other direction.
• metadata-protocol, the whole suite under the same probe: 337 passed / 7 skipped files; 22803 passed / 36 skipped tests. 0 binding reads, because its doubles carry no overlayRowBinding, so main's count applies there.

Scratch cases on both builds. I ran 17 scratch cases twice: once on the head, once on main's exact read.

• Faces read: plain exact read, layered read (getMetaItemLayered with packageId), list, and execution list.
• Shapes:
  • residual 1, both orders;
  • residual 2 in 4 registration and storage orders;
  • residual 2 with each holder of each App disabled in turn, in two shapes of App B;
  • observation (a), both orders.
• Result: 38 cells differ, and every one goes from "served or listed on main" to "no item or left out on the head". 0 cells move toward serving.
• The layered read at ?package=X&member=fr-FR moves too: overlay and effective go from pair fr-FR to null. This follows by construction, because the code layer at an exact address is judged as the plain read judges it (metadata-protocol: a package-less row of a two-holder name is still served at both exact addresses for package-scoped types outside PACKAGE_SCOPED_READ_TYPES (action first) (ADR-0150 D4) #32407). Nit, no change owed: the changeset's FROM → TO lines name the plain read and both lists, but not this layered face.

Bare names: the changed line runs only for exact-address callers (six exactQualifierItem call sites in the item and layered reads, each gated on exactAddress) and for the list scoped to a package. No bare read reaches it.

(2) Ambiguity is reported, never guessed: holds

• Every moved face goes toward no owner's row. X, Y and P each answer their own shipped item of the member (none, so 404) or leave the row out of their lists. The pair's own address keeps the row. No moved face picks a holder. The two-owner refusals are unchanged: in the P+P2 shape, ?package=P&member=fr-FR is 409 naming P and P2 on both builds.
• Order. The PR pins residual 1, residual 3, M1 and n1 in both orders. Residual 2's pin uses one order, so I ran three more on the head: A's row stored first; Y installed before U; and both. All three give the same cells as the pinned order (both bindings "no package", ?package=Y and ?package=P no item, each pair's own address serves its row). Residual 1 gives identical cells in both orders on the plain read, the layered read and both lists.
• No by-order path is left on the faces this PR moves. By-order paths nearby, older than this PR and not touched by it:
  • metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 (open, pm:blocked): the bare read of a name held only by stored rows of two enabled packages answers by save order, while /layers refuses. Its Blocked-by: #32354 is still open, although metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354's PR fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 merged at 2026-11-13T18:04:56Z. Seat bookkeeping.
  • metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 (open, pm:queue): the six sealed served-override types and the overlay list filter judge a declared override against the first shipper only.

(3) Every child is independently releasable: holds

• Blocked-by. metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 lists only metadata: overlaySlotBinding's other readers (bundleMembersHeldBy, getEnvironmentScopedItem) bind a pair row without reading overrides.package (ADR-0150 D4) #32408, closed 2026-11-13T03:14:02Z.
• Phase-1 one-holder pins: green. 10 files, 631 / 631 passed:
  • registry-bare-name-one-holder.test.ts and its ai, flow and request family files;
  • metadata-sync-flow-two-holders, registry-namespace-co-owner-names, hook-binder-package-scope, package-scoped-e8-readers, manifest-service-residual-namespace-name and protocol-flow-custom-override.
  • Plus the whole objectql and metadata-protocol suites above.
• Additive.
  • One optional interface method and one new read-only public method.
  • No stored shape, column, index or URL changes.
  • Registry readers are unchanged.
  • Bare names are unchanged, as in (1).
  • A registry without overlayRowBinding keeps the exact read's own count.
• ADR-0087. node scripts/check-adr-0087-registration.mjs --base origin/main --head HEAD exits 0 and prints: "1 declared-breaking changeset(s) … [BREAKING+bang+clause-②-narrowing+metadata-protocol-narrowed] registered pair-row-exact-read-no-owner (new here)".
  • --self-test exits 0. check-changeset-no-major --base origin/main exits 0.
  • The generated migration registry (588 semantic entries) contains pair-row-exact-read-no-owner.
  • The entry names no mechanical rewrite, so nothing guesses a row's base.
• Declarations (read). The changeset has minor on @objectstack/metadata-protocol and @objectstack/objectql and patch on @objectstack/spec, plus the **BREAKING** banner. The title is fix(metadata-protocol)!:. Body and changeset both carry Clause-②: yes (narrowing) and Metadata-protocol: narrowed. The changeset carries adr-0087: registered, and the body carries Skills-docs: none with its reason.

Seat-routing observations

• (a) X holds the name only through its own bare-slot stored row: follow-up, not a red-line issue. Measured in both orders, on both builds, with identical cells:
  • ?package=X&member=de-DE serves pair de-DE, and overlayRowBinding answers X.
  • X's list and execution list are ["suitex en-US"], without the row.
  • The exact read serves the row to its one owner, as main does, which is no guess. The lists serve less, not more.
  • This is a list-versus-exact-read disagreement: the list door does not count a package that holds only through its own stored row. It is older than this PR and not moved by it.
  • Route: a p3 follow-up card, or a checklist item on metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 like that card's item 4.
• (b) A second App's undeclared row keeps this pair's row bound to no package while one of that App's holders is disabled (residual 2): not a red-line issue, no card owed. Measured with each of App B's holders disabled in turn (P and Q in the P+Q shape, P and P2 in a P+P2 shape):
  • App A's row stays bound to no package, and ?package=Y&member=es-ES answers no item where main served pair es-ES.
  • Meanwhile the adoption binds App B's own row to B's enabled holder, which serves it, as on main.
  • Disabling one of App A's own holders instead (U or Y) binds A's row to the other A holder, which serves it, as on main (R4-A).
  • The move goes toward no owner and never picks. It sits inside the declared residual-2 line ("the registry binds neither"): the registry's own every-holder binding binds neither row in every case measured.
  • Unifying the disabled-state count across pairs is the family card that ruling 6837007729 already names, not this card.

Carried paths and their cards

• The declared-row shape of 6841146506, measured in 6863197549 as main's and not moved here: carried as metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 item 4 (open, pm:queue).
• metadata-protocol: the bare member read ignores a pair override declared for an addition package's own locale member #32849 (open, pm:blocked, sub-issue of metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561): the bare member read ignores a pair override declared for an addition's own locale member. Not touched by this PR, which carries Fixes #32561. After the merge it stays blocked by metadata-protocol: a pair row declared for package X is served at an addition package Z's exact address as Z's item, where the registry answers Z's own (ADR-0150 D4, red line 2) #32606.
• metadata-protocol: a pair row declared for package X is served at an addition package Z's exact address as Z's item, where the registry answers Z's own (ADR-0150 D4, red line 2) #32606 (open, labelled pm:queue and pm:blocking): a row declared for X is served at addition Z's exact address. Its body says Blocked-by: #32561, which this PR closes.
• metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 and metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131: the by-order paths in (2).
• Seen in passing. These read the same on main and at this head (harness double, not through the doors, not diagnosed), and none is by-order. The seat decides whether to measure them further:
  1. P+Q shape with P disabled: Q, an addition to the disabled P, serves App B's undeclared fr-FR row at ?package=Q, because no served holder pairs it, so the last arm serves it. overlayRowBinding answers Q too.
  2. Residual 2 with Y disabled: ?package=com.acme.suite.custom&member=es-ES answers no item. Meanwhile the disabled Y's list carries pair es-ES, and U's address serves it.
  3. Shape (a): ?package=Y&member=de-DE, where Y holds nothing, refuses 409 naming X and com.acme.suite.custom. The pair id is listed as a candidate package.

Scratch worktree /home/user/rl33148 was removed after this read. Nothing was pushed, and nothing was written to GitHub.

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-13T21:39Z · head dd283faf40257bc209debc3d3aa66e11345f7405

Verdict: ACCEPT: Fixes #32561. Not governed, 7 files, +350 / −9 (check-governed-merges --pr 33148). This seat (the sole epic seat of #31527) lands it, per the maintainer's order to carry the epic's already-branched p2 cards to merge and the standing order that seats review and land with pm-dispatch.

席位核对

1. Shape: draft PR to main, Fixes #32561, ! title, Clause-②: yes (narrowing) / Metadata-protocol: narrowed, BREAKING banner, adr-0087: registered pair-row-exact-read-no-owner, Skills-docs: none with its reason.
2. Reviews: review#1 FAIL 6863299225 on 72c8a9c8 (M1, M2, S1, n1); delta FAIL 6864576272 on this head (M1, S1, n1 closed; M2 body-only); close-out PASS 6865065266 on this head after the body edit, no finding open.
3. Epic red lines: re-read PASS 6865563363 on this head merged with main 702c562c1f: every moved face goes from served to refused or left out (8 of 42 bindings moved in the full objectql suite, all toward no owner); phase-1 one-holder pins 631/631; check-adr-0087-registration exit 0.
4. Verification on this head (report on the PR body): focused 375/375; ablations A1–A4 red, restored 375/375; metadata-protocol 22803 passed and objectql 12843/12843, both typechecks 0; 94/94 gates exit 0; lint 0; full dogfood 3886 passed, 0 failed.
5. Gates on this head: 71 check-runs, 58 success, 13 skipped, none failed or pending. K = 8, mergeable_state: clean, no conflict with main.
6. Carried: metadata-protocol: the bare member read ignores a pair override declared for an addition package's own locale member #32849 (the open sub-issue, the bare member read) stays open and is not touched here. The declared-row shape of 6841146506 → metadata-protocol: a second holder's declared .custom override is still judged against the first shipper only, for the sealed served-override types and the overlay list filter (ADR-0150 D4 follow-ups of #32613) #33131 item 4. The list-versus-exact-read observation in the Acceptance notes (X holding the name only through its own stored row) is routed to triage by this seat. Residual 2 under a disable in another App is inside the declared move (ruling 6837007729).
7. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that metadata-protocol: the exact read binds an undeclared App-pair row to X even when an addition package ships the same bundle member, where the registry binds it to no package (ADR-0150 D4, red line 2) #32561 closes.