fix(objectql): judge an authored action artifact-shipped by each holder's owner key, not by bare name - #33271

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 6 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/objectql/src/action-handler-coordinate.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/objects.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/kernel/services.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/permissions/authentication.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via ObjectQLPlugin (symbol, a top-level class))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via ObjectQLPlugin (symbol, a top-level class))
• content/docs/releases/v17/17-1.mdx (via ObjectQLPlugin (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 699b186e50e529a73081207e5a948d63fe60838f && git checkout 699b186e50e529a73081207e5a948d63fe60838f
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 24f2f4014d0c9bbd43ec6928942fa44b21c1dff6 efef4782e2d3383e25e732b74136739929681d0e && git checkout -B drift-repro 24f2f4014d0c9bbd43ec6928942fa44b21c1dff6 && git merge --no-ff efef4782e2d3383e25e732b74136739929681d0e

node scripts/docs-audit/affected-docs.mjs --json 24f2f4014d0c9bbd43ec6928942fa44b21c1dff6

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 24f2f4014d0c9bbd43ec6928942fa44b21c1dff6 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head ab806df · 2026-11-14T15:25:21Z

review#3 (area-lease pilot #33059).

Contract review

Served-tier: TIER_DEFAULT
Head-sha: ab806df240348e20541288f4a5b4d803d7304563
Local-runs: none

① Derived judgments

• isArtifactShippedAction now skips an authored row only when some holder's artifact owns the row's object (standaloneActionOwnsRoute: same owner key, or an object-less artifact). Checked the edge the table does not list: an object-less environment row (owner key global) beside a holder's artifact on account is now bound under metadata-service; dispatch at /actions/account/approve still probes account first (the holder's handler), and only objects no holder owns fall through to the environment's global handler (actionHandlerObjectKeys). Correct under D4.
• artifactActionsNamed: the bare-name first match plus each holder's own artifact (packageScopedHoldersOf(..., { includeDisabledPackages: true })), deduplicated by identity. Disabled holders keep their object. Matches the stated rule.
• should-fix S1 — the override base is still picked by list order when two artifacts share the row's owner key. isDeclaredArtifactActionOverride takes artifacts.find((a) => standaloneActionOwnerKey(a) === objectKey). For two holders whose approve is object-less (both key global), find returns the first by registration/bare-name order, so a declared B.custom override of B's object-less action is judged against A (isServedOverrideRowOf(row, A, installed) → false) and stays unbound, B's body runs. That is row 3's defect in the object-less shape. Fix (small, fold here): among artifacts at the row's owner key, take the one whose _packageId equals action.overrides?.package when given; with several and no package named, do not pick (return false and say so once). Add a pin with two object-less holders in both registration orders.
• Row 2 (one holder, environment row on another object: not found → the environment's body runs): resolution and the declaration the route serves are unchanged (#32365 case 1); only the missing handler is added. I read it as within the epic's "one-holder behaviour unchanged" red line (a dispatch that failed now runs the declared item); seat may confirm.
• action-handler-coordinate.ts: docblock only, matches the code.

② Semver level

@objectstack/objectql: patch; Clause-②: yes (widening) is right (dispatches that answered not-found now run the declared body; no refusal added, no export/schema moves). Metadata-protocol: none holds.

③ Boundary flags

• Author login objectstack-fleet[bot] (relay); area E2b. Hot shared file packages/objectql/src/plugin.ts (A4/E2b/E1 per amendment 6): confirm no other open PR edits isArtifactShippedAction / isDeclaredArtifactActionOverride before landing.
• CI not complete when read; the ACCEPT re-reads every check at the landing head.

Implemented-by: claude/area-E2b-32990
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: FAIL

S1 (≤30 lines + pin) → delta review by review#3.

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head efef478 · 2026-11-14T16:56:44Z

review#3.

Contract review

Served-tier: TIER_DEFAULT
Head-sha: efef4782e2d3383e25e732b74136739929681d0e
Local-runs: none

Delta over my FAIL at ab806df240348e20541288f4a5b4d803d7304563 (comment 6879713494). The diff ab806df2...efef4782 has two commits and touches packages/objectql/src/plugin.ts and plugin-authored-actions.test.ts.

① Derived judgments

• S1 fixed. isDeclaredArtifactActionOverride no longer takes artifacts.find(...) by list order. Among the artifacts at the row's owner key, it takes the one whose _packageId is the row's overrides.package. A lone holder at the key is taken as before, so one-holder behaviour is unchanged. With several holders and none named, it picks no base: the row is bound as no override, and a once-per-process warn names the holders and the fix ("name the base package in the row's overrides.package"). That matches the ADR-0150 red line "ambiguity reported, never guessed".
• Pin. Two object-less holders (both keyed global), a declared override of B, in both registration orders: B runs the override and A runs its own body. Before the fix, the "B then A" order is the case that bound against the wrong base.
• Test double. The booted-kernel row-store find now honours ast.limit, so the double no longer answers more rows than the caller bounded. That is a test-only change and it tightens fidelity.
• A row naming a package that is not among several holders at its key gets no base and is reported. A row naming a package other than a lone holder is judged by isServedOverrideRowOf against that holder, as before.

② Semver level

Unchanged from the first record: @objectstack/objectql: patch, Clause-②: yes (widening). The new no-base outcome only arises with several holders at one key, which the first record already treated as the per-holder widening.

③ Boundary flags

• CI at this head when read (16:58Z): 33 success, 16 skipped, 1 in progress, none red. The ACCEPT re-reads every check at the landing head.

Implemented-by: claude/area-E2b-32990
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: PASS

domain:server#5 · os-elon-musk · session_016WV4cyWLSMyXZGc6dwhCAu
ACCEPT · area E2b (area-lease pilot #33059) · 2026-11-14T17:01Z

• Fixes: objectql plugin: a package's script-bodied action is not bound when its name is shipped by another holder — judge "artifact-shipped" by owner key, not by name #32990
• Review: review#3 delta PASS on head efef4782 (comment 6881064488; first-round S1 fixed: the override base is the holder overrides.package names at the owner key; several holders and none named ⇒ no base, warned; pinned in both registration orders).
• Governed: check-governed-merges --pr 33271 ⇒ NOT governed; 281 changed lines ≤ 3000.
• Checks on efef4782: 35 success, 16 skipped, 0 failing; mergeable clean.
• Landing: ready + auto-merge by the area thread (Elon 15:21Z in the E2b thread: area PRs that pass review may be readied and auto-merged).