[objectstack-fleet]

Requested by Elon · project thread

Fixes #32948
Fixes #32826

Clause-②: yes (widening)
Metadata-protocol: none

维护者速读

• 改了什么：POST /analytics/dataset/query（含批量接口每一条）在"一行无主的存储行挡在 App 两个模块各自地址上"时，不再对所有调用者答 503；改为按该模块自己的数据集判准入：能查的模块在 409 里点名，不能查的不点名，一个都不能查答 404，被挡住的模块永不执行。另外：仍然答 503 的情形，服务端日志写明是哪些持有包判不了、为什么；拒绝识别函数合并成一份；文档补齐。
• 为什么改：ADR-0150 D4 说这种行不属于任何一个持有包，名字应当以 409 点名持有包拒绝；原来的准入规则把每个模块地址上的拒绝当成"判不了"，于是对所有人 503。
• 风险与回滚：只动"按名读被拒"的准入分支里"持有包自己地址被争用"这一种拒绝形状；其他形状仍判不了、仍 503。有一格是放宽（另一个包的持有项是调用者唯一能查的，503 → 200 并执行它，与 rest + service-analytics: the dataset query door judges admission before it resolves, and the dataset tools run a holder's effective (overlay-first) item (ADR-0150 D3, ADR-0149 D2) #32292 的一格规则一致），已声明 yes (widening)；该放宽只在裸名读取上发生，在某个模块自己的 ?package= / ?callerPackage= 上，另一个包的持有项不在被拒候选里，不会被跨过去执行（答 404，或 409 只点名该模块）。只剩一个可查持有包的 409 文案不提、不计数任何被隐藏的持有包。回滚即 revert 本 PR。
• 先看：packages/rest/src/analytics-dataset-admission-order.ts（isOwnAddressContention 与 judge 两处，风险在"被争用的持有包永不执行"）；packages/rest/src/analytics-routes.ts 里的 listHolder（只取该持有包自己的那一项）；packages/rest/src/analytics-routes.test.ts 的 [#32948] 钉子。
• 两分钟验证：pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/analytics-routes.test.ts -t '32948|32826'，预期 10 个用例全部通过。
• 需要你做的：无，席位落地。

What changes

Premise check first. The card's literal composition does not answer 503 on main (ba35dfd78) or on PR #32808's landing head (c50d10c00): a package-less dataset row beside the App's two modules is declined at each module's own address for a dataset (epic ruling 6817768147, the [#32568] pin already in this file), so ?package=APP.custom is judged over the modules as if the row were not there (both admitted 409 naming both, one admitted runs it, none 404). Measured over seven stagings (the row in the registry's bare slot with _provenance: 'org', stamped sys_metadata or '', before or after the modules; a stored sys_metadata row with package_id null; a metadata service copy stamped '', sys_metadata or unstamped), with and without the pair installed, both orders: each module's own exact read serves its own dataset. That composition is now a CONTROL pin.

The 503 the card describes is real in a sibling form, the one the #32804 review (N5) said "can be staged with the registry's own registerItem": an App pair's row that names no module, hydrated into the registry's bare slot (the registry binds it to no package; stamp APP.custom). Either module could own it, so it is no one holder's customization (ADR-0150 D4; epic ruling on #31699 F2), and each module's own exact read refuses ambiguous-in-closure, read as that module and naming both. The admission arm read every per-holder refusal as "cannot be judged", so on main the bare read, a module's ?package= and a module's ?callerPackage= all answered 503 for every caller, in both orders, single door and batch alike.

Now admitRefusedDatasetHolders recognises that one shape (isOwnAddressContention: ambiguous-in-closure, callerPackageId the holder itself, only package candidates, the holder among them) and judges such a holder on its own dataset as the list scoped to it serves it (getMetaItems({ type: 'dataset', packageId, names: [name] }), which withholds the row; only an item stamped with that holder counts). That is how query_dataset judges every holder. A contended holder is never picked or run; admitted, it is named in the 409; not admitted, it is not named. Every other refusal of a holder's own read stays undetermined, as before.

Moved answers (refusal arm only, plugin-wired admission):

Case (holders' own addresses contended)	FROM	TO
admitted to two or more holders	503 SERVICE_UNAVAILABLE	409 RESOURCE_CONFLICT naming those holders
admitted to exactly one contended holder	503	409 naming that holder only, nothing run
admitted to none	503	404 NOT_FOUND, byte-equal to a missing name's
admitted only to another package's holder whose address is not contended (bare read)	503	200, that holder runs (the one-admitted rule of #32292, now reached): the widening arm
the same caller at ?package= or ?callerPackage= a contended module	503	404 NOT_FOUND, byte-equal to a missing name's; that holder is not a refused candidate there, so it is never reached across to
admitted to that holder and to one module, at that module's ?package= or ?callerPackage=	503	409 naming that module only

An ambiguity narrowed to one contended holder gets its own sentence instead of the vocabulary's "is held by 1 packages … address it by its package", which would be wrong twice (a count of one, and a remedy that answers the same refusal). The sentence speaks of that one package and the row only: The dataset "NAME" cannot be read at package "ID": a stored row of the name stands beside that package's item and is not saved under it, so nothing is run until the row is saved under a package (ADR-0150 D4). It names, counts or implies no other holder: a holder the caller may not query stays hidden, and the refusal body carries only code and message (no candidates, reason or details). Seat amendment (2) on this PR replaced an earlier wording that said the row was one "no one package owns".

#32826 (loose ends of PR #32804), folded in:

1. Real-arrangement pins. The contention form is pinned over the real SchemaRegistry and ObjectStackProtocolImplementation (the [#32948] pins). The package-less form is declined, already pinned by [#32568]. The first-read form that never reaches the per-holder catch (the App pair address itself refusing, two modules holding the name) is pinned by the #32501 describe's judgedOverAdmission, which landed with fix(metadata-protocol)!: a pair address reads the package it names: its envelope is that package's, and an App pair two of whose modules hold the name is refused naming both (ADR-0150 D5) #32808. No staging measured here still reaches the per-holder undetermined path through a real refusal; the protocol double that pins it now says which shape it stands for.
2. The 503's cause. The undetermined answer carries a cause naming each holder that could not be judged and why (its own read refused, with the reason; its address served nothing; its admission was unresolved; contended but not listed). The door's logError prints it. The body is unchanged and names no holder.
3. One recogniser. isPackageScopedRefusal is exported from analytics-dataset-admission-order.ts and used by the door and the rule; the copy in analytics-routes.ts is gone.
4. Partial-judgement wording. Docs only: content/docs/data-modeling/analytics.mdx says a 409 reached with some holders unjudged names only the judged ones. The changeset half points at a released CHANGELOG.md entry and is split out (Acceptance notes).
5. Docs clause. The page says what the door answers after this fix: a package-less row moves no answer for a dataset; an App pair row that names no module contends each module's address, and such a module is judged on its own dataset.
6. Census wording. ambiguous-in-namespace stays in the rule's ambiguity set, with the reason in the comment: only a namespace address is refused with it, the dataset doors never name a namespace, and listing it keeps an ambiguity from ever being judged as outside-closure.

Tests

packages/rest/src/analytics-routes.test.ts, ten new cases:

• [#32948] in the #32501 describe (real registry and protocol; analytics double admitting by object; both() drives the single door and a one-entry batch): the contention pin, both orders, on the bare read, ?package= a module and ?callerPackage= a module, every admission cell; the widening pin with a third package registered first and last (bare read); the module-address pin, both orders, at ?package= a module and ?callerPackage= a module with that third package present: admitted to it alone answers the missing name's 404 byte for byte, admitted to it and one module answers 409 naming that module only; every one-module 409 cell (contention pin and module-address pin) also asserts the hidden holder is neither named nor implied: body keys exactly code and message (batch entry status and error), no hidden id in the text, no holder count, and none of packages, holders, other, another, both, each, either, no one, ambiguous, pick in the sentence; CONTROL: a package-less row beside the two modules, ?package=APP.custom judged as with no row; CONTROL: one module, the pair row is its customization, served, admission not asked.
• [#32826] in the #32292 describe: the undetermined 503 logs an error whose cause names both unjudged holders and the refusal reason; the body names neither.

Red on main, green here, one ablation per pin. Each ablation leg went through scripts/ablation-replace.mjs (anchor 1 → 0, blob moved, restored blob equal to HEAD, git diff HEAD empty). The tests import the rule and the door from source, so no rebuild between legs. Leg M put origin/main's blobs of both source files (05e9c422, 662e822c) under this head's tests and restored them with git checkout HEAD -- PATH, blob-checked.

Pin	HEAD	M (main)	A1 ABLATE_32948_NOJUDGE (contention not judged)	A2 ABLATE_32948_RUNNABLE (a contended holder runnable)	A3 ABLATE_32826_NOCAUSE (no cause)	A4 (the earlier one-holder sentence restored)
contention: 409 naming the admitted modules, none run, none → 404, hidden holder not implied (one first / two first)	green	red (503)	red	red	green	red (the sentence matches the implication pattern)
widening: another package's sole admitted holder runs; with a module, 409 names both (alpha first / last)	green	red (503)	red	green	green	green
module address: the uncontended holder not reached across to; 404 alone, 409 naming the module only, hidden holder not implied (alpha first / last)	green	red (503)	not run	red (the module runs)	not run	red
the undetermined 503 logs its cause	green	red	green	green	red	green
CONTROL: package-less row beside the modules (two orders)	green	green	green	green	green	green
CONTROL: one module, pair row served	green	green	green	green	green	green

Leg M, A2 and A4 were rerun at cfc3b3dd3 over the ten cases: M 7 failed / 3 passed (every module-address cell 503); A2 4 failed / 6 passed; A4 4 failed / 6 passed; each restored blob-equal to HEAD with git diff HEAD empty. A1 and A3 rows are from head 7eae0dea1 and were not rerun for the new pin.

Acceptance notes

• Seat amendment (1), measured otherwise than asked: the amendment asked for the widening (sole admitted holder uncontended, 200) at ?package=MODULE and ?callerPackage=MODULE too. There the read refuses the module's name over the two modules only; the third package's holder is not a refused candidate, so the one-admitted rule never sees it. Running it would serve another package's dataset at a module's exact address, a pick that address does not make. The pin asserts what the door answers: 404 (byte-equal to a missing name's) for the caller admitted to that holder alone, 409 naming only the module for the caller admitted beside it. Moving that to 200 would be a further widening and a seat call; it is not in this PR.
• Split out (rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826 item 4, changeset half): the consumed changeset of PR fix(rest): the dataset query door judges admission on the refusal arm before it names holders (ADR-0150 D3 after ADR-0149 D2) #32804 now lives in the released packages/rest/CHANGELOG.md entry. Its pointer "so the row above applies to it" points at the 503 row, and it has no row for a 409 reached with some holders unjudged. That amendment is a docs-only PR to the released entry, owned by the area session.
• Door-local sentence: the one-holder narrowed ambiguity is worded in the rule, not in @objectstack/core's vocabulary. The structured reason and candidates are the vocabulary's.
• Noted, not filed: the protocol's own refusal at a contended module address (GET /meta/dataset/NAME?package=MODULE) also says "address it by its package", which answers the same refusal there. The text is in @objectstack/core and @objectstack/metadata-protocol; this PR does not touch it.
• Not measured: a real kernel boot reaching the App-pair-row-in-the-bare-slot state through its own load path (the fix(rest): the dataset query door judges admission on the refusal arm before it names holders (ADR-0150 D3 after ADR-0149 D2) #32804 review said the same of its staging). The registry staging is the one N5 named.

Verification

Local, at head cfc3b3dd3 (source and tests; b89bfcd08 after it touches only the changeset and the docs page):

• pnpm --filter @objectstack/rest test: Test Files 411 passed (411), Tests 8397 passed, 332 skipped (lock verdict command-exit 0).
• pnpm --filter @objectstack/rest typecheck: exit 0.
• eslint --no-inline-config over the three touched source and test files: exit 0.
• Dispatch-derived gate families: node scripts/pm/dispatch-gates.mjs --commands derived 95 families against merge base 34c05229f at head 7eae0dea1; 93 exit 0; 2 exit 3 PREREQUISITE NOT MET, NOT MEASURED here and left to CI (pnpm --filter @objectstack/spec run check:skill-examples needs the client SDK packages built; pnpm check:dual-build-cjs-loads needs every package's dist/). --ran reconciliation: 95 derived, 93 run, 2 NOT-MEASURED, 0 UNRUN. Those 95 were read at 7eae0dea1; for the amendment the 27 docs, changeset and prose families among them were rerun over b89bfcd08's tree, all exit 0, and node scripts/check-nul-bytes.mjs OK. No dogfood battery: no ! in the title and no (narrowing) arm.

---

Generated by Claude Code

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 11 documentable anchor(s).

25 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f068cde84d272d25c451003996f3752bd016001b.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f068cde84d272d25c451003996f3752bd016001b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 0d77ea3d3bd1f82e3e25bd938b80e5c3b66d527d — the merge of head b89bfcd08d3ae799053b7ff46f1aeca750baf94d into base f068cde84d272d25c451003996f3752bd016001b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0d77ea3d3bd1f82e3e25bd938b80e5c3b66d527d && git checkout 0d77ea3d3bd1f82e3e25bd938b80e5c3b66d527d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f068cde84d272d25c451003996f3752bd016001b b89bfcd08d3ae799053b7ff46f1aeca750baf94d && git checkout -B drift-repro f068cde84d272d25c451003996f3752bd016001b && git merge --no-ff b89bfcd08d3ae799053b7ff46f1aeca750baf94d

node scripts/docs-audit/affected-docs.mjs --json f068cde84d272d25c451003996f3752bd016001b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f068cde84d272d25c451003996f3752bd016001b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cz4f7zEQZ2C9GTG382
Request: review · area E2b · head 7eae0de · Fixes #32948 #32826

Area notes for the reviewer:

• The card's exact setup (package-less row beside two modules) does not reproduce 503 on main; the 503 is real for an App pair row naming no module in the registry's bare slot (each module's own exact read refuses ambiguous-in-closure). That is what this PR fixes and pins red on main; the card's exact setup is a CONTROL.
• Open reading sent to the seat: a contended holder the caller is NOT admitted to — judged on its own listed dataset (implemented, A; gives 503 → 404 for admitted-to-none and 503 → 200, the widening arm, when the sole admitted holder is uncontended) vs left undetermined (B; those two cells keep 503, only admitted-contended cells move to 409). Please weigh A against red line 1.
• rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826 folded (items 1, 2, 3, 5, 6 and item 4's docs half); item 4's released-CHANGELOG half goes to a docs-only PR.

[objectstack-fleet]

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head 7eae0de · 2026-11-14T22:36:35Z

review#3.

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw
Seat ruling on the open cell (2026-11-14T22:36Z), reviewed once before posting: A, with amendments. The declared Clause-②: yes (widening) is accepted. The binding grounds are ADR-0150 D4 and "a holder the caller may not query does not exist for it". MCP parity (ADR-0149 D2) supports this but is not binding.

1. A holder whose own read refuses ambiguous-in-closure as itself, naming only packages that include itself, is judged on its own listed item (_packageId === holder).
2. Such a holder is never runnable. It is named in the 409 if the caller is admitted to it, and absent if not.
3. A caller admitted to no holder gets 404, byte-equal to a missing name. This removes the existence oracle that 503 leaves.
4. Every other per-holder refusal stays undetermined (503).
5. Pin the widening under ?package=<module> and ?callerPackage=<module> with the uncontended holder present. Today it is pinned on the bare read only.
6. Neutralise the one-holder 409 sentence. When the 409 names exactly one admitted holder, its wording must not say or imply that another holder exists. It names the admitted holder and the reason only, so a caller cannot learn of a sibling module it is not admitted to. Pin it with a test asserting the hidden holder is neither named nor implied.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 7eae0dea1eaec6dbe3d7e78d48e1c18e06411b91
Local-runs: none

① Derived judgments

• The recognizer is narrow. isOwnAddressContention accepts exactly the shape the exact read throws for a row that two or more holders could own: ambiguous-in-closure, read as that package, every candidate a package, the holder among them. Every other refusal of a holder's own read stays undetermined, as before, so a 503 is still answered wherever it could move the answer. isPackageScopedRefusal now exists once in the package, and the door and the arm both ask it.
• What a contended holder is judged on. listHolder reads getMetaItems({ type: 'dataset', packageId: holder, names: [name] }) and keeps only an item stamped _packageId === holder. That is the holder's own definition, with the row no one owns withheld. A list failure is a 503, a list refusal leaves the holder unjudged, and a contended holder is never run (read absent, so it is never picked). A single admitted contended holder gets a 409 naming only it, with a door-local sentence. That replaces core's "held by 1 packages … address it by its package", which would be no remedy there.
• Red line 1 ("resolution never loosened"), weighing A, your question. A does not loosen resolution, in my reading.
  • (a) Under ADR-0150 D4, the contending row is no holder's customization, so the holder's own item is its definition. Judging admission on it is the same judgment query_dataset makes over the list. It is not a guess.
  • (b) Once every holder is judged, the cells A moves are the existing rule, seat ruling 6817809380 (Q1 = A): with none admitted, 404, byte-equal to "nothing holds it"; with exactly one runnable holder admitted, run it. They are reached now, not invented.
  • (c) Nothing runs at a contended address in any cell, and a caller is never told about a holder it is not admitted to.
  • B keeps those two cells at 503 for every caller, permanently, although every fact the answer needs is known. That is fail-closed, but it reports an outage that is not one.
  • So I would rule A. This is a review judgment for the seat's needs-ruling, not a ruling.
• The 503 cause (rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826). The cause names each holder that could not be judged, and why. It is on cause, so it reaches logError, and the body sentence is unchanged (pinned). Nothing reaches the caller.
• Declaration. Clause-②: yes (widening), Metadata-protocol: none, patch is correct. The moved cells all leave a 503 (a fault answer, not an outcome a caller relied on) for a determinate 409, 404 or 200. No answer a caller got before is withheld now. The CONTROLs keep unchanged: a package-less row (declined at each address, ruling 6817768147) and one module.
• nit N1: listHolder takes listed.items or an array, and drops anything else silently. A protocol that answers another envelope would leave the holder unjudged, so it is fail-closed. A one-line comment saying so would help the next reader.

② Semver level

@objectstack/rest: patch, Clause-②: yes (widening), Metadata-protocol: none. Correct for a non-protocol widening (AGENTS.md).

③ Boundary flags

• This lands on the seat's A/B ruling. The PASS is for A as implemented. If the seat rules B, the two "not admitted to a contended holder" cells go back to undetermined. That is a code delta, and it comes back to me.
• Draft. CI was still running at this head when I read it (23:05Z). The ACCEPT re-reads every check at the landing head.

Implemented-by: claude/area-E2b-32948
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: PASS

[objectstack-fleet]

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head b89bfcd · 2026-11-14T22:51:46Z

review#3 (delta).

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: b89bfcd08d3ae799053b7ff46f1aeca750baf94d
Local-runs: none

This reviews the delta 7eae0dea...b89bfcd0 (4 files, +58/−6) on my PASS at 7eae0dea1eaec6dbe3d7e78d48e1c18e06411b91, after the seat's ruling on this PR (A, with amendments 5 and 6).

① Derived judgments

• Amendment 6: done. The one-holder 409 sentence now reads "cannot be read at package "M": a stored row of the name stands beside that package's item and is not saved under it, so nothing is run until the row is saved under a package (ADR-0150 D4)". It names the admitted holder and the row only, with no plural and no "other" or "no one package". hiddenHolderNotImplied runs in every one-module 409 cell (bare, ?package=M1, ?callerPackage=M2, both orders, single and batch). It asserts that the body carries only code and message, with no hidden id, no count, and none of the sibling words. The changeset and analytics.mdx say the same.
• Amendment 5: measured, and it deviates from the ask. At ?package=<module> and ?callerPackage=<module>, the read refuses over the two modules only. The uncontended third holder is therefore not a candidate there, and a 200 at a module's address would be a pick that red line 1 forbids. The pins assert what the door answers: admitted to the uncontended holder alone gives 404 (byte-equal to missing), and admitted to it plus one module gives a 409 naming that module. Both are 503 on main. That is the correct answer under the ruling's own items 1–3. The 200 widening stays pinned on the bare read, where the uncontended holder is a candidate. The changeset now says so. I agree with the measurement. Because it answers amendment 5 differently from how it was worded, the seat should acknowledge it before landing.
• Code: one string and a comment. The arm's logic is unchanged from 7eae0dea.

② Semver level

Unchanged: @objectstack/rest: patch, Clause-②: yes (widening) (accepted by the seat), Metadata-protocol: none.

③ Boundary flags

• Landing condition: the seat acknowledges the amendment-5 deviation, where the module-address cells are 404/409 and not 200.
• The ACCEPT re-reads every check at the landing head.

Implemented-by: claude/area-E2b-32948
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: PASS

[objectstack-fleet]

domain:server#5 · os-elon-musk · session_016WV4cz4f7zEQZ2C9GTG382
ACCEPT · area E2b (area-lease pilot #33059) · 2026-11-14T23:30Z

• Fixes: rest: the dataset query door answers 503 at an App pair two modules share beside a package-less row under plugin-wired admission, where ADR-0150 D4 calls for 409 naming both (follow-up of #32292) #32948 rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826 (rest: loose ends of PR #32804 — real-arrangement pins for the refusal forms, the 503's cause and log line, one shared refusal recogniser, prose (follow-up of #32292) #32826 item 4's released-CHANGELOG half is docs-only PR docs(rest): name the 503 row and add the partial-judgement row in the released 2fc3fce CHANGELOG entry #33495).
• Review: review#3 PASS on 7eae0dea (comment 6885304152) and delta PASS on head b89bfcd0 (comment 6885470650). Clause-②: yes (widening), @objectstack/rest: patch.
• Seat 5 ruling on the PR: A (a contended holder the caller is not admitted to is judged on its own listed dataset; the bare-read widening accepted), with two amendments: the one-holder 409 sentence is neutral and pinned never to name or imply a hidden holder (done); the module-address cells are pinned at what the door answers (404 / 409 naming the one module), which the seat accepted at 22:50Z in place of a 200 there (the uncontended holder is not a candidate at a module address).
• Governed: check-governed-merges --pr 33491 ⇒ NOT governed; under 3000 lines.
• Checks on b89bfcd0: 40 success, 17 skipped, 0 failing.
• Landing: ready + auto-merge by the area thread (Elon 15:21Z in the E2b thread).