[objectstack-fleet]

Requested by Elon · project thread

Fixes #32607

Clause-②: yes (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — no skill and no doc teaches what the read naming no package answers for a name only stored rows of several packages hold (skills/** and content/docs/** grepped: the ambiguous-in-environment mentions are about flow, queue and permission-set references, not /meta reads); the refusal's own sentence names the ?package= remedy.

BREAKING (ADR-0087 registered, semantic entry two-row-holders-bare-read-refused): the read naming no package of a name two or more enabled packages hold only as stored rows, and that no package ships in code, answers 409 RESOURCE_CONFLICT naming each holder, where it served the row saved first. First-party count: 0. Remedy: name the package (?package=), which serves that package's row.

维护者速读

• 改了什么：两个都启用的包各自存了一行同名元数据、而没有任何包在代码里自带这个名字时，不带包名的读取（裸读 GET /meta/TYPE/NAME、/published、执行读）现在答 409 并点名这两个包；以前它按保存顺序返回先存的那一行。/layers 本来就答 409，保持原样不动。
• 为什么改：同一个名字，裸读答“先保存的那一行”、/layers 却答 409，答案取决于保存顺序，等于替调用方猜了一个包，违反史诗红线 2（歧义要报告，不许猜）。
• 风险与回滚：收紧（narrowing，BREAKING，metadata-protocol minor），第一方 0 处。只有一个包存了行、有包在代码里自带该名字、带 ?package= 的精确读、被拒的行（declined）、某包的定制配对行、依赖包给行持有的基础包追加的语言成员，答案都不变。第 2 轮按复审修了 5 处（见 Round 2）。回滚 = revert 本 PR。
• 先看：packages/metadata-protocol/src/protocol-meta-item-face.ts 的 storedRowHoldersRefusal（只按行的粒度判持有者）与 readMetaItemFace（把读到的行交给 readMetaItem）；packages/rest/src/rest-server.ts 与 packages/runtime/src/domains/meta.ts 各一个 catch 块（让 /layers 继续答写入口的 409）；packages/runtime/src/domains/meta-disabled-holder-served-stack.test.ts 的 [#32607] 组。
• 两分钟验证：pnpm --filter @objectstack/rest exec vitest run src/meta-disabled-package-doors.test.ts -t 32607，预期全部通过：两种注册顺序 × 两种保存顺序下裸读都是 409 点名两个包，单持有者 CONTROL 仍答 200。
• 需要你做的：无，席位落地。

What changes

servedRowHolderOf (@objectstack/metadata-protocol, the row-aware served-holder judgment #32354 landed in #33130) answered only when some package was disabled. With no disabled package it returned undefined, so the plain read fell through to findServedOverlayRow, which takes the first row by save order, while packagelessLayeredReadRefusal counted both bindings and refused 409. Same name, two doors, two answers, and one of them a guess.

Now the item face (readMetaItemFace, which the plain read, /published and the execution face share) asks the judgment with { refuseWithoutDisabled: true }:

• With no disabled holder, and only for a name no enabled package ships at any member (shippedArtifactsOf(type, name), the set packagelessContentPackage already counts), storedRowHoldersRefusal judges the holders at ONE grain: the packages the item's active rows are bound to at the member, as the read binds them (packagelessAddress), less rows the reads decline and rows of a customization pair of another package the rows or the registry name. It never unites them with the registry's holders of the name (one bare slot, the row written or hydrated last). Two or more are refused with the by-name read's own refusal (ambiguous-in-environment, details.candidates); one or none: undefined, the read as it was.
• The rows that judgment reads are read on the face's cache key and handed to readMetaItem (PrereadActiveRows), which takes them for the same item: the item face reads the item's active rows once (data reads: every GET /api/v1/data read makes five serial sys_metadata reads of the target object's own active row (about 250 ms at 50 ms RTT) #24371).
• A shipped name never fell to save order: the read's own content judgment counts the shipper. So a bundled type's base shipping one member beside another package's row of another member (an email template's en-US shipped, a dependent's fr-FR row) keeps its answer. The first dogfood run on 3b9a447dc3 caught exactly that over-reach (three metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802 pins, expected { status: 409 } to deeply equal { status: 404 }); abd91aad9e adds the guard.
• Every other caller of the judgment (the layered read's re-addressing and packagelessLayeredReadRefusal) passes no option and is unchanged, so /layers keeps the package-less writes' refusal (meta: with two package holders of one dashboard name, GET /meta/dashboard/X/layers silently returns one holder's overlay while package-less save and delete answer 409 #28337, ruling Q1 = A, 6820653691).
• A1 (6821134180) and its runtime twin (6836791341): each transport's layered chain reads the plain read first to find a disabled owner (step 1b). That read now refuses, so step 1b catches the refusal and, when it is this judgment's own refusal (marked under the registered symbol objectstack.metadata-protocol.storedRowHoldersRefusal) and step 1c (packagelessLayeredReadRefusal) has a refusal for the address, hands over to it; every other error is rethrown as before.

Door, naming no package (E, F enabled, each storing a row of d1; no package ships d1)	Before	Now
GET /meta/:type/:name	200, the row saved first	409 RESOURCE_CONFLICT, details.candidates = E, F
GET /meta/:type/:name/published	200, a row (RestServer: the row saved first; runtime dispatcher: the same package in every save order)	409 RESOURCE_CONFLICT naming E, F
execution face (getMetaItemForExecution)	the row saved first	the same refusal
GET /meta/:type/:name/layers	409, the package-less writes' refusal	unchanged
?package=E / ?package=F	that package's row	unchanged
one package storing a row (CONTROL)	200, that row	unchanged
a name an enabled package ships at any member (e.g. base ships en-US, a dependent stores fr-FR), package-less fr-FR read	404 / the pair's row	unchanged
a package's row beside its customization pair's undeclared row (M1)	that read's own pick	unchanged: no door refuses or names the pair
email_template: base stores en-US (nobody ships it), a dependent stores fr-FR (M2): plain read, /layers, execution face at fr-FR	the dependent's row	unchanged
/layers of a name two packages ship in code, each with its own stored row (S1)	the plain read's refusal	unchanged

Both transports (RestServer, the runtime HttpDispatcher), both registration orders, both save orders, and on the runtime dispatcher before and after a reboot.

Files: protocol-meta-item-face.ts, protocol-meta-item-reads.ts and protocol.ts (the hand-over of the rows read once), the A1 hunks in rest-server.ts and runtime/src/domains/meta.ts, the pins in rest/src/meta-disabled-package-doors.test.ts and runtime/src/domains/meta-disabled-holder-served-stack.test.ts, the semantic entry packages/spec/src/migrations/entries/semantic/18.two-row-holders-bare-read-refused.ts, and two changesets (metadata-protocol minor + rest, runtime patch, BREAKING, adr-0087: registered; spec patch for the entry).

Tests

• packages/rest/src/meta-disabled-package-doors.test.ts, describe [#32607] RestServer: two enabled row holders and no shipper: NARROWING over 2 registration orders × 2 save orders (plain read 409 with details.candidates, /layers and /published 409 naming both and serving no row, execution face rejects RESOURCE_CONFLICT/409, each ?package= serves its own row); A1 (/layers of two enabled row holders leads with the writes' sentence); A1 CONTROLs (two code holders, and two served row holders beside a disabled one, keep the plain read's refusal on /layers); CONTROL (one row holder served on every bare door).
• packages/runtime/src/domains/meta-disabled-holder-served-stack.test.ts, describe [#32607] two enabled row holders and no shipper: the same NARROWING on a booted kernel over the runtime dispatcher, 2 registration orders × 2 save orders, before and after a reboot, plus the /layers vs /published sentence split; CONTROL one row holder, before and after a reboot.
• runtime/src/domains/meta-disabled-holder-served-stack.test.ts, describe [#32607 M1, M2] the no-disabled arm judges holders at the rows' grain: M1, a package (com.qa.rowpairbase) and its pair each storing an undeclared row, both save orders, before and after a reboot: the plain read and /published answer 200 and no door refuses or names the pair, each order answering the same before and after the reboot. M2 (n1: a bundled type at a non-canonical member), base storing en-US, dependent storing fr-FR, both save orders, before and after a reboot: the plain read, /layers and the execution face at fr-FR serve the dependent's row; the base's en-US stays the base's. /published takes no member selector (400 VALIDATION_ERROR), so it is not asked at fr-FR.
• REST, A1 CONTROL (S1): two packages ship a name in code, each with its own stored row; /layers keeps the plain read's refusal, not the writes' sentence.
• The meta: with two package holders of one dashboard name, GET /meta/dashboard/X/layers silently returns one holder's overlay while package-less save and delete answer 409 #28337 pins (rest/src/meta-layers-ambiguous-package.test.ts and the runtime twin) are untouched and green.
• The data reads: every GET /api/v1/data read makes five serial sys_metadata reads of the target object's own active row (about 250 ms at 50 ms RTT) #24371 one-read pins in objectql/src/protocol-meta.test.ts (red on CI at 5d3a6c757c, Test Core 4/8) are green again.
• The shipped-name guard is pinned by the existing dogfood file packages/qa/dogfood/test/email-template-dependent-unshipped-locale-read.dogfood.test.ts (metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802, booted showcase), which this PR leaves untouched.

Premise re-measured on main 89d7bef033 (this branch's tests, main's three source files): the runtime [#32607] NARROWING pins went 4 failed / 2 passed; quoted: {"success":true,"data":{… "label":"enabled row", "_packageId":"com.qa.row_alpha" …}}: expected [ 200, undefined ] to deeply equal [ 409, 'RESOURCE_CONFLICT' ] (E saved first) and … "label":"third row", "_packageId":"com.qa.row_gamma" … (F saved first). The bare read still answered by save order.

Ablation 1 (the item face's { refuseWithoutDisabled: true } replaced by an expression esbuild folds to false; metadata-protocol rebuilt; ablation-dist-preflight found refuseWithoutDisabled: false } in 2 built files, and refuseWithoutDisabled: true } in 0): runtime 4 failed / 18 passed of 22, REST 6 failed / 33 passed of 39, exactly the NARROWING and A1 pins. Quoted: AssertionError: {"type":"dashboard","name":"two_rows_dash","item":{… "label":"healthy row" …}}: expected [ 200, undefined ] to deeply equal [ 409, 'RESOURCE_CONFLICT' ]. Restore leg: ablation-replace --restore blob equals HEAD, git diff HEAD empty, rebuilt, preflight --absent: marker absent from all 24 built files, tree clean.

Ablation 3 (the shipped-name guard: !anyDisabled replaced by (globalThis as any).__ABL32607B === 1; metadata-protocol rebuilt; preflight: marker present in 2 built files): the #28802 dogfood file 3 failed / 10 passed of 13, quoted AssertionError: expected { status: 409 } to deeply equal { status: 404 } (×2) and expected { status: 409 } to deeply equal { status: 200, …(3) }. Restore leg: blob equals HEAD, git diff HEAD empty, rebuilt, preflight --absent: absent from all 24 built files, tree clean.

Round 2, measured before the fix (head 1ab9370442, the shared-read fix alone): M1 409 naming com.qa.rowpairbase and com.qa.rowpairbase.custom; M2 409 naming the base and the dependent. On main 89d7bef033 (main's five source files put back): M2 green, and M1 answers exactly as on this head (no refusal; the row served follows the save order, see Carried).

Ablation 4 (the one grain: the registry's holders united back into the holders, marker __ABLU32607 in 2 built files): runtime 3 failed / 22 passed of 25, the M1 and both M2 pins, quoted RESOURCE_CONFLICT … package "com.qa.rowpairbase"; package "com.qa.rowpairbase.custom" and … package "com.qa.mailrowaddon"; package "com.qa.mailrowbase". Restored, rebuilt, --absent clean. (A first attempt was a no-op: its replacement text contained the anchor and ablation-replace refused it; that run is not counted.)

Ablation 5 (S1: the REST hand-over takes any error, marker condition dropped; src import, no build): 2 failed / 42 passed of 44, the two A1 CONTROL (S1) pins, quoted {"error":"Name the package this layered read is for, … where the plain read's sentence was expected. Restored, git diff HEAD empty.

Ablation 2 (REST A1: step 1b's hand-over return false replaced by throw error; the suite imports ./rest-server.js, no build): 3 failed / 39 passed of 42: the two [#32607] … A1 pins and the #28337 pin (both spellings answer the package-less writes' 409 …). Restore leg: blob equals HEAD, git diff HEAD empty.

Acceptance notes

• This branch resumes claude/project-thread-j3i5j5@d721d9a125 and merges origin/main once (89d7bef033, merge commit 3b9a447dc3). The merge takes main's landed copies of every file the old branch carried from metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354's pv4nip and metadata-protocol: a pair address (?package=<base>.custom) takes its envelope from the first registered holder of the name, so it answers one package's body under another's _packageId #32501 (main's fix(metadata-protocol)!: a name a disabled package holds through a stored row is judged over the served set, never by save order (ADR-0150 D3) #33130 and fix(metadata-protocol)!: the exact read no longer serves an undeclared App-pair row the registry binds to no package; it adopts SchemaRegistry#overlayRowBinding over the served holders (ADR-0150 D4) #33148), drops the patch copy cb73bf6c, and replays the card's own seven commits (ef9fceb2 … d721d9a1) onto them. Two files conflicted: protocol-meta-item-face.ts (main's served-row filter for declined and pair rows, servedAddressJudgment and the member-selector resolution, with the card's option threaded through them) and the REST doors test (two describe blocks appended at the same place, both kept). The diff against main is this card's ten files only; three commits follow the merge (abd91aad9e, the shipped-name guard, 5d3a6c757c, its changeset sentence, and 2eb2f7c258, round 2). At the seat's landing request (the head was 25 commits behind), origin/main was merged a second and last time (67274acad6, merge commit f20d249baf): clean, protocol.ts auto-merged (fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served #33119's hunks are elsewhere in the file), and the diff against main is still the card's ten files, 613+/21−.
• Declaration moved since the claim of record: Metadata-protocol: none (seat ruling 6820653691) → narrowed, per review#1's ruling on fix(lint)!: os validate and os build resolve a dashboard's dataset through the reader's declared closure, as the runtime does #33121 (a refusal of a read that served before) and the seat's re-posted claim 6866219396. Hence minor, the BREAKING banner, ! and the ADR-0087 entry.
• Not moved here, carried elsewhere: the paired customization address after a reboot (?package=HOLDER.custom, metadata-protocol: after a reboot, the pair address X.custom of a name held only by stored rows of two enabled packages answers by hydration order (one 200, the other 409 naming one side) (ADR-0150 D3, red line 2) #32662); details.candidates on /layers (metadata-protocol + rest: the layered read (/meta/:type/:name/layers) of a name two packages hold answers as the plain read — 409 with details.candidates, never the first holder (ADR-0150 D3/D5; collects #32622 #32624) #32622); the REST /layers answer for two registry holders (rest: GET /meta/:type/:name/layers of a name held by two registered packages answers 200 with the first holder instead of the 409 the plain read and the dispatcher /layers give (ADR-0150 D3, red line 2) #32624, sequenced after this card on the same chain).

Round 2 (review#1 FAIL 6868755969 on 5d3a6c757c, and CI Test Core 4/8)

• S2 / CI: one read of the item's active rows on the item face again (PrereadActiveRows); objectql protocol-meta.test.ts 94/94.
• M1, M2: holders judged at the rows' grain only (storedRowHoldersRefusal); pinned as asked, red before the fix, green after; ablation 4.
• S1: only the row judgment's own refusal is handed over (registered-symbol marker read by both transports); pinned; ablation 5.
• n1: M2 is the first pin on a bundled type at a non-canonical member.
• The changeset's "Not moved" paragraph now states the one grain, the marker, M1 and M2.

Carried (for the seat to route)

• A package-less row beside two packages' rows of the name: rows.unbound leaves the read as it was, so the plain read still takes a row by store order while /layers refuses naming both. Not covered by this PR. Carried by metadata-protocol: a package-less row beside two packages' rows of one name (no shipper) is served by store order on the plain read while /layers refuses — follow-ups of PR #33182 (#32607) #33210 (p2, triage ruling 6870700526: red line 2 decides, refuse 409 as /layers does), together with review#1's n2 of 6870642184 (a row-held base's added member answers the dependent's row where a shipped base answers 404).
• M1's shape (a package's row beside its customization pair's undeclared row, nobody ships the name): no refusal and no pair named any more, but which row the plain read and the execution face serve follows the save order (X then pair saved: X's row; pair then X: the pair's row; /published serves X's row in both), measured identically on main 89d7bef033. It is the plain read's own pick between a base row and its pair's undeclared row, not this judgment's. Folded into metadata-protocol: after a reboot, the pair address X.custom of a name held only by stored rows of two enabled packages answers by hydration order (one 200, the other 409 naming one side) (ADR-0150 D3, red line 2) #32662 (triage ruling 6870700526).
• metadata-protocol: the writer's registry keeps one bare slot per stored name, so after one package saves a name two packages store, the other's exact address answers nothing (ADR-0150 D4) #32663 (the registry's one bare slot per stored name) lands after this card; this judgment no longer reads the registry's holders, so it does not move with it.

Verification

All readings on the final head f20d249baf (the second merge of main), under the lock, VERDICT command-exit 0. Round 2's readings on 2eb2f7c258 (objectql 12863, metadata-protocol 22803, rest 8360, runtime 10599, dogfood 3905) were all green as well, and are superseded here.

Affected suites and typecheck

One locked run: the dogfood closure rebuilt (pnpm --filter '@objectstack/dogfood^...' build), then each suite in full.

• pnpm --filter @objectstack/objectql test: Test Files 595 passed (595); Tests 12903 passed (12903), including the data reads: every GET /api/v1/data read makes five serial sys_metadata reads of the target object's own active row (about 250 ms at 50 ms RTT) #24371 one-read pins CI's Test Core 4/8 failed on at 5d3a6c757c.
• pnpm --filter @objectstack/metadata-protocol test: Test Files 338 passed, 7 skipped (345); Tests 22810 passed, 36 skipped (22846).
• pnpm --filter @objectstack/rest test: Test Files 409 passed (409); Tests 8360 passed, 332 skipped (8692).
• pnpm --filter @objectstack/runtime test: Test Files 597 passed (597); Tests 10624 passed, 19 skipped (10643).
• typecheck of metadata-protocol, objectql, rest: exit 0. runtime: its check:test-typecheck ran out of heap locally (the session's NODE_OPTIONS overrode the script's 4096 MB default, leaving 2 GB); re-run with --max-old-space-size=4096, as CI sets it: exit 0, "27 file(s) / 183 error(s) / 66 pinned signature(s) held".
• test:repo (vitest repo project) not run locally: the diff touches no file of that project; CI's Test Core runs it.

dispatch-gates

node scripts/pm/dispatch-gates.mjs --commands derived the same 97 commands from 10 paths vs merge base. All 97 exit 0 on f20d249baf, including check:dual-build-cjs-loads, type-check-coverage, type-check-debt, dts-closure, lean-entry-closure, published-files and spec check:browser-reachable-entries. dispatch-gates --ran (record /mnt/project-files/epic-31527-seat2/cards/32607-thread/ran-r3.txt): "97 derived famil(ies) accounted for — 97 run, 0 NOT-MEASURED". node scripts/check-test-source-alias.mjs exit 0; node scripts/check-nul-bytes.mjs exit 0.

Lint and dogfood

pnpm lint (eslint, whole repo) on f20d249baf: exit 0.

Full dogfood battery on f20d249baf (! title, Clause-②: yes (narrowing)), closure rebuilt after the merge, no shard, no path: Test Files 464 passed, 3 skipped (467) · Tests 3927 passed, 42 skipped (3969) · no failure. The #28802 file (email-template-dependent-unshipped-locale-read.dogfood.test.ts) is green in it.

Round 1 for the record: the first battery on 3b9a447dc3 was red in that file, 3 tests (expected { status: 409 } to deeply equal { status: 404 }), fixed in abd91aad9e.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4czBmkW6UeWPazkWq7L

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/metadata-protocol, @objectstack/rest, @objectstack/runtime, @objectstack/spec, touching 15 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/kernel/cluster.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 179 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 6e1ab9b286655c5476312ae563ab531f3f36cf38 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 52b05f7903afc65297d89744b11dffd7e2f1769c — the merge of head f20d249baf18db795aaaf2edb6bb601da64539f9 into base 6e1ab9b286655c5476312ae563ab531f3f36cf38, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 52b05f7903afc65297d89744b11dffd7e2f1769c && git checkout 52b05f7903afc65297d89744b11dffd7e2f1769c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6e1ab9b286655c5476312ae563ab531f3f36cf38 f20d249baf18db795aaaf2edb6bb601da64539f9 && git checkout -B drift-repro 6e1ab9b286655c5476312ae563ab531f3f36cf38 && git merge --no-ff f20d249baf18db795aaaf2edb6bb601da64539f9

node scripts/docs-audit/affected-docs.mjs --json 6e1ab9b286655c5476312ae563ab531f3f36cf38

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6e1ab9b286655c5476312ae563ab531f3f36cf38 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 5d3a6c7 · 2026-11-14T00:32Z

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5d3a6c757c49d4696db84da62689b37c2ac4f92f
Local-runs: none
Scope: .changeset/32607-two-enabled-row-holders.md, .changeset/32607-two-row-holders-semantic-entry.md, packages/metadata-protocol/src/protocol-meta-item-face.ts, packages/rest/src/rest-server.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/runtime/src/domains/meta.ts, packages/runtime/src/domains/meta-disabled-holder-served-stack.test.ts, packages/spec/src/migrations/entries/semantic/18.two-row-holders-bare-read-refused.ts, and the PR title and body + read as cited code, not reviewed: readMetaItem in packages/metadata-protocol/src/protocol-meta-item-reads.ts, packagelessAddress and packagelessContentPackage in protocol-environment-rows.ts, readItemActiveRows in protocol-stored-overlay-reads.ts, packagelessLayeredReadRefusal in protocol.ts, packageScopedHoldersOf, overlaySlotBinding, settledPairRowBinding, isBundleAddition, getPackageScopedItem and getEnvironmentScopedItem in packages/objectql/src/registry.ts, packages/objectql/src/package-scoped-read.ts, pairsOf in packages/metadata-core/src/customization-pair-lookup.ts, content/docs/concepts/metadata-lifecycle.mdx, content/docs/data-modeling/import-mappings.mdx

Contract review and epic red-line read of card #32607, read at 2026-11-14T00:46Z. Inputs: the card and its rulings (6820653691, 6821134180, 6836791341), the diff of this head against merge base 89d7bef0, the PR title and body, report 6868555489, the check-runs on this head, knock 6868544976. Claim 6868561553. Every finding below is by reading; nothing was run here.

① Derived judgments

• The declaration lines are present and of the right kind: Clause-②: yes (narrowing), Metadata-protocol: narrowed, Skills-docs: none, the BREAKING banner, the ! title, adr-0087: registered with the semantic entry. A read that served and now refuses is narrowed, as declared.
• Skills-docs: none holds by this seat's own reading. No skill and no docs page teaches the row saved first. The pages that speak of a name two packages hold (import-mappings.mdx, analytics.mdx, permission-sets.mdx) already teach the refusal naming each, so the read now agrees with them. The lifecycle page's bullet on a dependent's added locale teaches a base that ships, which the guard keeps.
• The FROM and TO table is right for the shape the pins cover: two enabled packages, one row each of one name at one member, no shipper, a type that is no bundle.
• Two "not moved" sentences do not hold as written, by reading: "pair rows make no holder" (M1) and "/layers keeps the package-less writes' refusal" together with the bundled-type row of the table (M2).

② Semver level

• Right: minor on @objectstack/metadata-protocol, patch on @objectstack/rest, @objectstack/runtime and @objectstack/spec.

③ Boundary flags

• Check-runs on this head at the time of reading: 64 runs, 26 success, 11 skipped, 27 in progress (Test Core 8 shards, Test UI 16 shards, three type checks), none failed. Check Changeset and the PR-body guards are green. The verdict below is FAIL, which does not wait for them.
• CI skipped the dogfood shards on this head (the gate job concluded in half a minute, its matrix skipped). The battery reading (462 files passed) is the report's.
• Order. Merge base 89d7bef0; main is at 1169d64f, twelve commits past it. None is on a path of this diff; fix(metadata-protocol)!: enabling a second holder of an overlay name takes back the package-less row the read-side hydrator laid into the first holder's registry slot while the second was disabled (ADR-0150 D4) #33149 and fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served #33119 add other files beside the new semantic entry. A git merge-tree of main and this head reports no conflict.
• Fixes #32607 closes a card whose sub-issue metadata-protocol: the writer's registry keeps one bare slot per stored name, so after one package saves a name two packages store, the other's exact address answers nothing (ADR-0150 D4) #32663 is open (the writer's registry keeps one bare slot per stored name). That card changes the registry holder set this judgment unions with the rows, so M1 and M2 read differently once it lands. The seat's to sequence.
• Residual left open by the declaration, no carrier named: a package-less row beside the rows of two packages returns the read "as it was" (rows.unbound), so the plain read still takes a row by store order while /layers refuses naming both. It is the card's own symptom on a neighbouring shape. The seat's to route.
• The row judgment's union and its pair filter also serve the arm metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354 landed for a disabled holder. M1's reading reaches that arm on main too; that part is not this diff's.

④ Design judgment

Red-line 1 read of the guard abd91aad9e (asked in the knock). It does not loosen resolution. The guard sits inside the arm this PR adds (no disabled holder), which main answered undefined without exception, and it returns that same undefined. It counts shippers as packagelessContentPackage counts them, at any member. No read main refused is served through it.

servedRowHolderOf, the new arm. The served set is the registry's holders of the name united with the packages the active rows are bound to at the member. With no shipper the registry knows a row-only name through one bare slot per member, the row written or hydrated last, while the rows name every package. The two sets are read at different grains (the name, and the member) and from different sources (one slot, and every row). The pinned shape is the one where that does not matter. M1 and M2 are two where it does.

The hand-over in both transports (isItemOfDisabledPackage) catches whatever the plain read throws and asks only whether step 1c has a refusal for the address. See S1.

The item face now reads the name's active rows once more on every read naming no package of a by-package type that no enabled package ships at the member and that has no environment item. See S2.

Findings:

• M1 must-fix. A pair's row beside a row-held name is counted as a second holder in one save order. Shape: package X stores a row of d, X's customization pair stores an undeclared row of d, no package ships d, nothing is disabled, any by-package type. When X's row is the bare slot's entry, the registry's holders are X, pairsOf(X) names the pair, the pair's row is filtered, one holder remains and the read is main's. When the pair's row is the entry, overlaySlotBinding binds it to the pair itself (no composite holder for the pair to be a pair of), the registry's holders are the pair alone, pairsOf of a pair is empty, neither row is filtered, and the read is refused 409 naming X and its own pair. So the answer follows which row was saved last, and a pair is named as a holder, against the docblock's own rule and the changeset's "pair rows make no holder". Asked: a pin of this shape in both save orders, before and after a reboot, on the plain read, /published and the execution face, showing one answer and no refusal naming a pair; and the judgment made to agree with it. If the pin is green at this head as written, post the reading and M1 is withdrawn.
• M2 must-fix. A dependent's added member over a row-held base is refused naming the base and the dependent, and /layers moves with it. Shape: email_template; base A stores en-US of a name nobody ships; D, which declares A, stores fr-FR. The registry holds A alone (D is a bundle addition, metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802). The rows at fr-FR name D. The union is two, so the read at fr-FR naming no package is refused 409 naming A and D, where metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802 says an addition is no second holder of the name. On main that read served D's row (packagelessContentPackage with no shipper takes the row's own binding). /layers at fr-FR was not refused on main and is refused 409 here: the owner step's read throws, step 1c has no refusal for one candidate, and the error is rethrown. The guard closes this only for a base that ships in code. Asked: the same pin on the plain read, /layers, /published and the execution face at the added member, and the holders judged at one grain. I did not read the write gate: if it refuses D's row over a row-held base, post that refusal and M2 is withdrawn.
• S1 should-fix. The hand-over does not look at what it caught. For a name two packages ship in code, each with its own bound overlay row, the owner step's read throws the registry's refusal (as on main), step 1c has a refusal for two bound rows, and /layers now leads with the writes' sentence where it led with the plain read's. The A1 CONTROL pins two code holders with no rows, so it does not reach this. Either hand over only the refusal the row judgment made, or declare this row and pin it. The comment "every other refusal is rethrown" is true of neither.
• S2 should-fix. One more store round trip on the hot path. host.readItemActiveRows(type, name) in servedRowHolderOf is the uncached read; readMetaItem then reads the same rows through the overlay cache. Before this PR the row read was skipped unless some package was disabled. It now runs on every execution-face read of a Studio-authored flow, tool, skill or agent, and on every miss. Share the read with readMetaItem, or take it through the cache as that read does.
• n1 nit. No pin covers a bundled type or a member other than the canonical one; every new pin is a dashboard. M2's pin would be the first.

Implemented-by: session_016WV4czBmkW6UeWPazkWq7L
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 2eb2f7c · 2026-11-14T02:26Z

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2eb2f7c258509846fc2659aaa96e2ba586d3c0e8
Local-runs: none
Scope: .changeset/32607-two-enabled-row-holders.md, packages/metadata-protocol/src/protocol-meta-item-face.ts, packages/metadata-protocol/src/protocol-meta-item-reads.ts, packages/metadata-protocol/src/protocol.ts, packages/rest/src/rest-server.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/runtime/src/domains/meta.ts, packages/runtime/src/domains/meta-disabled-holder-served-stack.test.ts (the interdiff), and the PR body as edited + read as cited code, not reviewed: readItemActiveRows in protocol-stored-overlay-reads.ts, packagelessAddress in protocol-environment-rows.ts, pairsOf in packages/metadata-core/src/customization-pair-lookup.ts; otherwise nothing beyond what record 6868755969 lists

Delta review of FAIL 6868755969, read at 2026-11-14T03:01Z. Inputs: the interdiff 5d3a6c75..2eb2f7c2 (one commit of this branch on eight files, no merge), the PR title and body as they stand, the check-runs on this head, knock 6870186526. Claim 6870182575. Everything that record judged and the interdiff does not touch stands as read there. Nothing was run here.

① Derived judgments

• The declaration stands: Clause-②: yes (narrowing), Metadata-protocol: narrowed, Skills-docs: none, the BREAKING banner, the ! title, adr-0087: registered. The interdiff moves no answer beyond the declared ones. It takes two shapes back out of the refusal (M1, M2) and one out of the hand-over (S1).
• The changeset's "Not moved" paragraph and the body's table now name those three shapes, and each sentence agrees with the code as read.
• The body's file count is ten, as the diff against the merge base is.

② Semver level

• Unchanged and right: minor on @objectstack/metadata-protocol, patch on @objectstack/rest, @objectstack/runtime and @objectstack/spec.

③ Boundary flags

• Check-runs on this head, all concluded: 71 runs, 58 success, 13 skipped, none failed. Test Core is green on all eight shards, shard 4 included; the type checks, the lints, Check Changeset (both runs, the second started by the body edit) and the PR-body guards are green. The dogfood shards were skipped by CI again.
• The body reports that Test Core 4/8 was red on 5d3a6c75 (the one-read pins of data reads: every GET /api/v1/data read makes five serial sys_metadata reads of the target object's own active row (about 250 ms at 50 ms RTT) #24371). That run was in progress when record 6868755969 was read; it is the same defect as that record's S2.
• Order. The merge base is still 89d7bef0; main is at 7257f57a, 24 commits past it. One is on a path of this diff: fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served #33119 on protocol.ts, in other hunks. A git merge-tree of main and this head reports no conflict. fix(metadata-protocol)!: a stored row bound to a package that holds none of its name, or a pair row of a two-holder name, is no longer laid into the first-registered holder's registry slot (ADR-0150 D4) #33166, landed since, judges a stored row under two code holders; the shipper guard keeps such a name out of this arm.
• The body's Carried section names the three things record 6868755969 left with the seat: the package-less row beside two packages' rows, the save-order pick between a package's row and its pair's undeclared row, and metadata-protocol: the writer's registry keeps one bare slot per stored name, so after one package saves a name two packages store, the other's exact address answers nothing (ADR-0150 D4) #32663. The seat's to route.
• The local runs (97 of 97 gates, the four suites, the dogfood battery, ablations 4 and 5, the red readings before the fix) are the report's; none was run here.

④ Design judgment

storedRowHoldersRefusal (M1, M2). Closed. The arm with no disabled holder now counts only the packages the item's active rows are bound to at the member, less the rows the reads decline and less a row whose package is a pair of another package the rows or the registry name. The registry's holders no longer enter the count; they only help recognise a pair. For M1's shape the base is always among the rows, so its pair's row is filtered in either order. For M2's shape the rows at fr-FR name the dependent alone. The pinned shape (two packages, one row each at one member) still counts two. The arm still only refuses or leaves the read as it was, so the red-line 1 read of record 6868755969 stands.

The hand-over (S1). Closed. The judgment marks its own refusal under a registered symbol and both transports hand over only a marked error. The refusal beside a disabled holder and the registry's refusal are not marked and are rethrown, as on main. The key is spelled in three files; the A1 pins on both transports fail if one drifts.

The one read (S2). Closed. The face reads the rows through the overlay cache and hands them to readMetaItem, which takes them only for the same type and name and otherwise reads as before. One consequence, judged acceptable: the judgment beside a disabled holder (#32354) now sees the rows the read sees, through the same cache, where it read the store afresh.

Red-line 2 read of the two residuals (asked in the knock). Neither is made or widened by this PR; both are main's answers, left as they were and named in the changeset and in Carried.

• (a) A package-less row beside the rows of two packages. This one is a standing departure from red line 2: three rows, no one holder, and the plain read serves one by store order while /layers refuses. The registry already says such a row is "a customization of a name it cannot say whose" and binds it to no package; the read does not follow. It is the card's own symptom one shape over, so it owes a card before Fixes #32607 closes the subject, and the answer (refuse naming both, or read past the package-less row) is a ruling, not a dev's pick. Not a must-fix here: the PR declares it unmoved and it is.
• (b) A package's row beside its pair's undeclared row. No second holder exists here, so nothing is guessed between packages: red line 2 in its strict reading is kept, and this PR now keeps the pair out of the refusal in both orders. What follows save order is which layer of one holder's stack is served, and by the report's measurement /published serves the package's row in both orders while the plain read does not. That is a determinism defect of the one holder's read, to be carried on its own card (it sits beside metadata-protocol: after a reboot, the pair address X.custom of a name held only by stored rows of two enabled packages answers by hydration order (one 200, the other 409 naming one side) (ADR-0150 D3, red line 2) #32662, the pair address after a reboot). Not this PR's.

The pins. M1 runs both save orders before and after a reboot and asserts no refusal on the plain read, /published and the execution face. M2 runs both save orders before and after a reboot at fr-FR on the plain read, /layers and the execution face, with the base's en-US as its control. The S1 control lays a row under each of two code holders. Each is reported red before its fix.

Findings:

• n1 of record 6868755969. Closed: M2 is a pin on a bundled type at a member other than the canonical one.
• n2 nit, new. The M2 pin fixes today's answer for a row-held base: the read naming no package at the added member serves the dependent's row. For a base that ships, the same read answers 404 (metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802, and the lifecycle page teaches it). The pin is right about main and about this PR; whether a row-held base should answer as a shipped one does is a question for the seat, and this pin is where that change would meet it. No change asked.

M1, M2, S1 and S2 of record 6868755969 are closed on this head. No must-fix, no should-fix.

Implemented-by: session_016WV4czBmkW6UeWPazkWq7L
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head f20d249 · 2026-11-14T04:25Z

[objectstack-fleet]

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-14T05:05Z · head f20d249baf18db795aaaf2edb6bb601da64539f9

Verdict: ACCEPT: Fixes #32607. Not governed, 10 files, +613 / −21 (check-governed-merges --pr 33182). This seat (epic:#31527#2, which keeps #32607 under ruling 6866786021) lands it, per the maintainer's order to carry the epic's already-branched p2 cards to merge.

席位核对

1. Shape: draft PR to main, Fixes #32607, ! title, Clause-②: yes (narrowing) / Metadata-protocol: narrowed, BREAKING banner, adr-0087: registered two-row-holders-bare-read-refused, Skills-docs: none with its reason.
2. Reviews (contract + epic red lines, both by review#1): FAIL 6868755969 on 5d3a6c757c (M1, M2, S1, S2, n1; the red-line read of guard abd91aad9e held); delta PASS 6870642184 on 2eb2f7c258: M1, M2, S1, S2 and n1 closed, no must-fix or should-fix, the red-line 2 read of the residuals is in that record.
3. The merge-only head: f20d249baf is one clean merge of main (67274acad6) on top of the PASSed 2eb2f7c258, made because the PR was 25 commits behind. review#1 claimed it (6871671735), then went offline with no record (6871889904), and the maintainer has paused contract review. The seat measured that the PR's own patch against its merge base, file by file over all 10 files, is identical on 2eb2f7c258 and f20d249baf apart from hunk line offsets: the merge brought in only main's commits. The maintainer ruled to land on the existing PASS (decision card answered 2026-11-14T05:05Z).
4. Verification on this head (report on the PR body): objectql 12903, metadata-protocol 22810, rest 8360, runtime 10624, all green; typecheck of the 4 packages exit 0; 97/97 derived gates exit 0, 0 not measured; lint 0; full dogfood 464/467 files, 3927 tests, 0 failed.
5. Gates on this head: 71 check-runs, 58 success, 13 skipped, none failed or pending. K = 5, mergeable_state: clean.
6. Carried: (a) the package-less row beside two packages' rows → metadata-protocol: a package-less row beside two packages' rows of one name (no shipper) is served by store order on the plain read while /layers refuses — follow-ups of PR #33182 (#32607) #33210 (p2, triage 6870700526: refuse 409 as /layers does), with review#1's n2; (b) a package's row beside its pair's undeclared row → folded into metadata-protocol: after a reboot, the pair address X.custom of a name held only by stored rows of two enabled packages answers by hydration order (one 200, the other 409 naming one side) (ADR-0150 D3, red line 2) #32662. Sub-issue metadata-protocol: the writer's registry keeps one bare slot per stored name, so after one package saves a name two packages store, the other's exact address answers nothing (ADR-0150 D4) #32663 stays open and is sequenced after this card; the judgment no longer reads the registry's holders.
7. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that metadata-protocol: a name held only by stored rows of two enabled packages answers the bare read by save order while /layers refuses 409 (ADR-0150 D3) #32607 closes.

[objectstack-fleet]

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

Contract review · merge-only delta · 2026-11-14T05:12Z

Reviewer: Opus subagent of the seat, on the maintainer's order「你自己用 opus 审查吧」 (review seat paused)
Head-sha: f20d249baf18db795aaaf2edb6bb601da64539f9
Delta of: PASS 6870642184 on 2eb2f7c258

Local-runs: none
No tests were run here: measured with git only (git diff, git merge-tree), read the code at the merged head, relied on CI and the card thread's green runs.
Inputs: records 6870642184 (PASS) and 6868755969 (FAIL), the PR body as it stands, compare/89d7bef033...67274acad6 (25 commits), the check-runs on this head, and main at 0b89b33978 when I read it.

(1) The interdiff

• f20d249baf has two parents, 2eb2f7c258 (the head review#1 passed) and 67274acad6 (main). It is the only commit the branch added since review#1. The merge base of the old head and main is 89d7bef033, as review#1 recorded.
• No conflict was resolved by hand. git merge-tree --write-tree 2eb2f7c258 67274acad6 gives tree 7dcde4a8ae, which is exactly the head's tree.
• The PR's own patch is unchanged. git diff 89d7bef033 2eb2f7c258 and git diff 67274acad6 f20d249baf match line for line once the index and @@ lines are removed. Both cover the same 10 files, with 613 insertions and 21 deletions.
• Nine of the 10 files are byte-identical on both heads: the two changesets, protocol-meta-item-face.ts, protocol-meta-item-reads.ts, rest-server.ts, meta-disabled-package-doors.test.ts, the runtime meta.ts, meta-disabled-holder-served-stack.test.ts, and the semantic entry. Their post-image blobs are the same.
• The tenth file, protocol.ts, differs between the heads only by main's fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served #33119 hunks. The head-to-head diff of that file equals main's 89d7bef033..67274acad6 diff of it, apart from offsets.
• main did not touch rest-server.ts or runtime/src/domains/meta.ts in this range. Their pre-image blobs are the same in both diffs, so the S1 hand-over code is what review#1 read.
• The S1 key Symbol.for('objectstack.metadata-protocol.storedRowHoldersRefusal') is spelled the same way in all three files at this head: protocol-meta-item-face.ts:247, rest-server.ts:3745 and runtime/src/domains/meta.ts:606.

(2) main's commits that meet the PR, judged one by one

I filtered the files of all 25 commits against two groups:

• The PR's paths: metadata-protocol/src, rest-server.ts, runtime/src/domains/meta*, the semantic entries folder.
• The code the PR relies on: metadata-core/src, protocol-environment-rows.ts (packagelessAddress, packagelessContentPackage), protocol-stored-overlay-reads.ts (readItemActiveRows and the overlay-cache read), protocol-artifact-lookup.ts (shippedArtifactsOf), and objectql/src/registry.ts (packageScopedHoldersOf, isPackageDisabled, readsByPackage, overlayRowBinding).

The following are unchanged by git diff --quiet 89d7bef033 67274acad6: protocol-meta-item-face.ts (including servedHolderAddressOf, servedRowHolderOf and isItemOfDisabledPackage), protocol-meta-item-reads.ts, protocol-environment-rows.ts, protocol-stored-overlay-reads.ts, protocol-artifact-lookup.ts, protocol-host.ts, installed-manifests.ts, protocol-exact-qualifier.ts, and all of metadata-core/src (pairsOf).

Four commits meet the PR. I also read a fifth, #33174, because its title mentions a refusal.

• 3e19223bf5 fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served #33119 (protocol.ts, the object_extension write door). Its protocol.ts hunks are three:

  • a type import, StoredCollectionTargetFold;
  • an optional fourth argument targetFold on foldStoredCollection;
  • an optional fifth argument withoutExtensionsOf on foldObjectExtendersFromRegistry.

  Existing callers pass neither argument and keep the old fold. The PR's hunks in this file are the PrereadActiveRows import and the readMetaItem opts type. They are separate hunks, and nothing in one depends on the other. The commit's other files (protocol-authoring-gate.ts, protocol-object-extender-fold.ts, protocol-stored-collection-fold.ts) are on the write or fold path, not the item read face. It also adds a semantic entry with a different id. Does not move the judgment.

• 16e3486420 fix(metadata-protocol)!: a stored row bound to a package that holds none of its name, or a pair row of a two-holder name, is no longer laid into the first-registered holder's registry slot (ADR-0150 D4) #33166, fixes metadata-protocol: the boot hydration binds a stored webhook row of a name two packages hold by registration or load order; key its artifact lookup by (package, name) (ADR-0150 D3/D4) #32692 (protocol-registry-hydration.ts, protocol-package-bindings.ts export only, and objectql/src/registry.ts overlayRowBinding). The read-side hydrator now:

  • declines a stored row bound to a package that holds none of the name while two or more others hold it;
  • dresses a pair's row of a two-holder name in the envelope of the holder it customizes.

  Three facts keep this out of the PR's arm:

  • Both changes apply only when there are two or more registry holders (holdersOfEvery). With no shipper, the registry knows a row-only name through one bare slot. The arm runs only when no enabled package ships the name, and a disabled shipper puts the read in the metadata-protocol: a name held only by stored rows of two packages, one disabled, answers by save order, and /layers takes the first composite when the environment holds its own item (ADR-0150 D3) #32354 arm instead (anyDisabled). So the two never meet. This is what review#1 named as the shipper guard.
  • The types the PR's pins use, dashboard and email_template, are in BORROWED_ENVELOPE_DECLINED_TYPES, which judgesRowHolder excludes. fix(metadata-protocol)!: a stored row bound to a package that holds none of its name, or a pair row of a two-holder name, is no longer laid into the first-registered holder's registry slot (ADR-0150 D4) #33166 is a no-op on every pinned shape.
  • overlayRowBinding gains an optional includeDisabledPackages, and without it the behaviour is unchanged. Its only caller with the option is the hydrator. Neither packagelessAddress (pure over the rows) nor servedRowHolderOf calls it.

  fix(metadata-protocol)!: a stored row bound to a package that holds none of its name, or a pair row of a two-holder name, is no longer laid into the first-registered holder's registry slot (ADR-0150 D4) #33166 only declines entries or binds them more strictly, so it narrows what the registry serves and never widens it. Does not move the judgment.

• 84c66d3671 fix(metadata-protocol)!: enabling a second holder of an overlay name takes back the package-less row the read-side hydrator laid into the first holder's registry slot while the second was disabled (ADR-0150 D4) #33149, fixes metadata-protocol: re-enabling a package leaves another holder's registry slot answering a package-less overlay row hydrated while it was disabled #32820 (protocol-registry-hydration.ts, plus a semantic entry with a different id). On enable, it rebuilds the registry entry of a package-less overlay row. Such a row was laid in under the one holder served at the time, for email_template, dashboard and report only.

  It acts only on package-less rows (!options.packageId). servedRowHolderOf returns undefined on rows.unbound before it reads the registry's holders or reaches storedRowHoldersRefusal. So a name with a package-less row is "read as it was" on both heads, and the M1 shape (a package's row and its pair's row, both bound) records nothing. Residual (a) from review#1, a package-less row beside two packages' rows, is neither closed nor widened. Does not move the judgment.

• 46a2ecf19f fix(metadata): the store declares its views where it builds them, and a not-held refusal names each holder once #33174 (packages/metadata/src/package-slotted-store.ts, metadata-manager.ts). This is the MetadataManager's slotted store: how views are marked, and refuseSlotNotHeld naming each holder once. It does not touch the protocol's PackageScopedNameRefusedError or packageScopedRefusalMessage, which the PR's refusal is built from. Does not meet the PR.

• The other 21 commits touch:

  • app-shell, console and UI: 588596af43, 9e235344f1, 1169d64f43, a5267906ed
  • lint: c09320d07e, 4c152685a7
  • mcp, and runtime/src/domains/mcp.ts (not meta.ts): 28a2f0f5a2, f45c012514, 88355328f0, 66919b66f7
  • cli: 58443466a5
  • storage: 5e250a6599, de31809330
  • auth: 68cb68e120, 30e364ea0f
  • platform-objects: 6a36b79c80
  • i18n: f5121e84d5
  • plugin-dashboard: 68972cd29c
  • docs: 47f6c939f1, 7257f57a68
  • hono request-body limit, which affects bodies only, while the PR's doors are GETs: 67274acad6

  None of them touches the PR's paths or the code it relies on.

Order after the merge: main has moved to 0b89b33978, five commits past 67274acad6. git diff 67274acad6 0b89b33978 is empty over the PR's 10 files and the relied-on files listed above. git merge-tree --write-tree f20d249baf origin/main is clean.

One of those five, #33189 (26b5994ad3, two shippers of one name with a declared .custom override), touches protocol-meta-list-reads.ts, protocol-lock-state.ts, protocol-diff-delete-load.ts and a new semantic entry with a different id. Its shape has shippers, which the PR's arm leaves out.

(3) Declaration and red lines

Declaration. Unchanged byte for byte: the changesets and the entry have the same blobs on both heads.

• Clause-②: yes (narrowing), Metadata-protocol: narrowed, Skills-docs: none.
• minor on @objectstack/metadata-protocol; patch on @objectstack/rest, @objectstack/runtime and @objectstack/spec.
• The BREAKING banner and adr-0087: registered two-row-holders-bare-read-refused.

The id two-row-holders-bare-read-refused appears only in the PR's three files. main's three new 18.* entries (package-less-overlay-row-holder-slot-on-reenable, stored-row-of-a-non-holder-under-two-holders, object-extension-door-computed-field-expression-judged) have distinct ids. No commit in range moves the semver level or the narrowing the PR declares.

The PR's judgment. The meaning of each part is unchanged on the merged head: storedRowHoldersRefusal (one grain, rows only, the shipper guard), servedRowHolderOf (the refuseWithoutDisabled arm), PrereadActiveRows (one read, taken only for the same type and name), and the S1 marker.

Red line 1, resolution never loosened. Holds. The arm still only refuses or leaves the read as it was. The two main commits that reach the hydrator only decline or rebind more strictly.

Red line 2, ambiguity reported, never guessed. Holds as review#1 read it. Its residuals (a) and (b) are left as they were by the merge and remain carried in the body's Carried section.

Red line 3, independently releasable. Holds:

• The patch is identical on a base without the 25 commits and on one with them.
• The PR does not depend on any of them, and none of them depends on the PR.
• The merge with current main is clean.

CI on this head when I read it: 72 check-runs, 59 success, 13 skipped, 0 failed.

(4) Findings

• must-fix: None.
• should-fix: None.
• n3 nit, new. It is outside the merge delta and was already on 2eb2f7c258. The ADR-0087 entry's reason in packages/spec/src/migrations/entries/semantic/18.two-row-holders-bare-read-refused.ts still says the read judges "the registry's holders and the packages its active stored rows are bound to".
  • Since the round-2 fix for M1 and M2, the registry's holders are no longer counted. They only help recognise a pair. The changeset says so: "never united with the registry's holders of the name".
  • The behaviour the entry promises is still right: 409 naming each holder, and the ?package= remedy. The mechanism it describes is round 1's.
  • This is not blocking, and the PR should not leave the queue for it. A one-line follow-up should fix it: "the packages its active stored rows are bound to at the member".
• review#1's n2 stands as written. No change is asked.

VERDICT: PASS