docs(changelog): amend the released history-by-package entry: the 18.4.0 type list, the legacy-row reading and the addressed diff - #33526

📓 Docs Drift Check

⚠️ 3 changed file(s) yielded no anchor (packages/metadata-core/CHANGELOG.md, packages/metadata/CHANGELOG.md, packages/platform-objects/CHANGELOG.md), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 3 changed package(s)).

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw
Request: review · area E2 · head 64369bf

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head 64369bf · 2026-11-14T23:38Z

review#3.

Review — changes needed

Head-sha: 64369bfbf80ad109fdabbd1ae40b515bb0829257

The PR is docs-only. It amends the released cac0f1a entry in three CHANGELOGs (metadata, metadata-core, platform-objects) with the same edits in each. A dedicated docs-only PR is the allowed form for amending a released entry (AGENTS.md, packages/*/CHANGELOG.md row). Each claim was checked against the @objectstack/metadata@18.4.0 tag (181ad7d4).

• Right.

  • The type list. PACKAGE_SLOTTED_STORE_TYPES at the tag (package-slotted-store.ts:141) is exactly api, agent, skill, action, email_template, permission, flow, picklist, mapping, dataset, webhook. tool came later, so leaving it out is correct.
  • "The refusals" instead of "the two refusals".
  • The addressed diff of an unattributed version answering "not found". At the tag, MetadataManager.diff reads getHistoryRecord(type, name, v, address), which returns null when historyRowAttribution(row) !== packageId, and then throws "Version N not found".

• must-fix M1: the legacy-row attribution edit makes the entry wrong. It appears twice in each file: the adr-0087 marker and the "Each history row names its package" upgrade sentence. The new text says a history row written before the column "keeps a NULL package_id and is attributed to none", and "only a rollback to it reads its package from the restored body's _packageId stamp". At the tag that is not what the code does:

  • historyRowAttribution(row) returns storedRowPackageId(row) unless the column holds the sys_metadata mark (database-loader.ts:298).
  • storedRowPackageId takes the column when it names a package, and otherwise parses the history row's own stored metadata body and returns its _packageId stamp (:2277).
  • Nothing on the save path strips that stamp from the snapshot. onlyBoundStampAdded only judges whether a save is a no-op.
  • So a legacy history row whose snapshot body is stamped is read as that package's at every door: an addressed getHistory / diff lists it under that package, and a rollback takes it as that package's. Only a row whose stored body names no package is attributed to none. The text you replaced ("read as the package its stored body names (the _packageId stamp), else as attributed to none") was correct.
  • The rollback half is also narrower than the new text says. The restored body's stamp is read only when the version's history row is absent or attributed to none (recorded !== undefined ? recorded : storedItemPackageId(restoredData), :1859).

  Suggested wording:

  • Upgrade sentence: "A row written before it keeps a NULL package_id and is read as the package its stored body names (the _packageId stamp), else as attributed to none; a rollback to a version attributed to none reads its package from the restored body's stamp."
  • adr-0087 marker: "no row written before it is rewritten: its package_id stays NULL, and it is read as the package its stored body names, else as attributed to none."

  This matches the doc that fix(metadata)!: a sole row slot's history and rollback answer its unattributed and environment versions at every door, a history row (never the body stamp) says whose version it is, and a rollback writes its body stamped for its slot (#32717) #33464 puts on sys_metadata_history.package_id.

A delta that changes only that text converts this to PASS.

Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6 (review#3)

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw
Request: review · area E2 · head 5f0d54e

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head 5f0d54e · 2026-11-14T23:40Z

review#3 (delta).

Review — PASS

Head-sha: 5f0d54e170c1fc6d709e3fbf289ef2453e07f624

Delta 64369bfb...5f0d54e1 on my changes-needed at 64369bfbf80ad109fdabbd1ae40b515bb0829257: one commit, the same text edit in all 3 CHANGELOGs, nothing else.

• M1 closed. The adr-0087 marker now reads "its package_id stays NULL, and it is read as the package its stored body names, else as attributed to none". The upgrade sentence reads "is read as the package its stored body names (the _packageId stamp), else as attributed to none; a rollback to a version attributed to none reads its package from the restored body's stamp". Both match historyRowAttribution → storedRowPackageId and rollbackSlot's recorded !== undefined ? recorded : storedItemPackageId(restoredData) at 181ad7d4.
• The other edits stand as I read them at 64369bfb: the 11-type list, "the refusals", and the addressed diff "not found".

skip-changeset fits a docs-only amendment of a released entry (AGENTS.md, packages/*/CHANGELOG.md row).

Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6 (review#3)

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw
ACCEPT · area E2 (area-lease pilot #33059) · Fixes #32717 · head 5f0d54e

• Review: review#3 PASS at 5f0d54e (record 6886040853), after changes-needed 6886009977 at 64369bf (M1, the legacy-row wording, now closed).
• Scope: docs-only amendment of the released cac0f1a entry, as AGENTS.md routes it (seat 5, 2026-11-14T23:32Z). skip-changeset applies.
• Governed: check-governed-merges --pr 33526 NOT governed (0 of 3 paths).
• Checks: running at ACCEPT. The red lanes at 64369bf were cancelled by the superseding push, plus Check Changeset from before the label. Auto-merge lands it only once every check at this head passes.
• fix(metadata)!: a sole row slot's history and rollback answer its unattributed and environment versions at every door, a history row (never the body stamp) says whose version it is, and a rollback writes its body stamped for its slot (#32717) #33464 (Part of metadata: history-by-package loose ends: one answer per rollback door for unattributed/env versions, stamp fallback only for an absent row, changeset type list and wording (follow-up of #32351) #32717) carries the card's code items under seat ruling 6885958183.
• Landing: maintainer's instruction in the area thread (15:21Z): PRs in this area that passed review go ready + auto-merge.

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 43669762601 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Dogfood Regression Gate (2/3) — 失败步骤: Boot example apps and exercise real user flows

  @objectstack/dogfood:test:  FAIL   isolated  test/upgrade-18x-index-equivalence.dogfood.test.ts > [18.x step 7b] the organization key part across the 18.0 → HEAD upgrade
    ↳ 失败原因: @objectstack/dogfood:test: Error: the ceremony's apply exited 1:
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/upgrade-18x-index-equivalence.dogfood.test.ts — 24h 窗口内只有本 PR 撞到过，暂不汇总（再有一个不同 PR 撞到就会自动开汇总 issue）。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 18 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw
Queue note · head 5f0d54e

Queue build 43669762601 failed in Dogfood Regression Gate (2/3), test/upgrade-18x-index-equivalence.dogfood.test.ts [18.x step 7b] ("the ceremony's apply exited 1"). This PR changes CHANGELOG text only, in three packages (skip-changeset), with no code, so it cannot move that ceremony. The cause is a flake or another PR in the same speculative group. This is this PR's first queue failure, so I am re-arming auto-merge once on the same head. If the same signature fails again, it waits for queue triage.