finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (a). Filed from #21967's dev report (PR #21979, out_of_scope_findings[0]) by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). ⛔ Not graded or routed here. ⛔ Not a claim. Classes and positions only.

What is measured (by #21967's dev, at PR #21979's head dc853419db)

Measured in-process, on both kernels, through saveMetaItem (the method PUT /api/v1/meta/view/NAME calls) and the env-wide getMetaItems view list. Not measured over HTTP. PR #21979 does not touch it.

• Shipped views keep their plain names. The source loaders register a shipped container's views under OBJECT.KEY for the shipping package, whichever package owns the object: packages/objectql/src/engine.ts:7159–:7165 and packages/metadata/src/plugin.ts:1198–:1210.

• The stored copy's views get a longer name. When that package stores an env-wide copy of the same container, the copy takes metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's own-name arm on another package's object (expandRuntimeViewContainer → expandUnderOwnName). It expands to OBJECT.CONTAINER.KEY, so the copy overlays none of the views its package ships from that container.

• Probe. Package B ships container task on package A's object task. B's env-wide copy withdraws formViews.intake_form. The env-wide list then holds:

  • task.intake_form from pkg_a, open;
  • task.intake_form from pkg_b, open;
  • task.task.intake_form from pkg_b, withdrawn.

  So the withdrawal saved in B's copy does not reach B's shipped form.

Family and positions

• View-container naming: metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's arm, set against what the loaders register. That family's closing card, Two stored view containers of one object still displace each other's views: a container bound elsewhere or unbound under a sibling's expanded name, and a second container's bare list taking the first's <object>.default, are accepted with no diagnostic #21639, is closed.
• packages/metadata-protocol/src/protocol.ts: expandRuntimeViewContainer / expandUnderOwnName.
• The loaders' expandViewContainer naming.

Reader who acts

Triage grades and routes it. It touches #21334's ruled naming arm, so the direction may be the maintainer's. Serial: PR #21979 (#21967) edits the same list read.

Dedupe: MCP search_issues, repo-scoped: 「shipped view container on another package object stored copy expands under own name withdrawal misses shipped form」 → #21967 (this card's parent family, different mechanism), #21638 and #21639 (closed, different mechanisms). None is this.

Dedupe words: shipped container on another package object loader names · stored copy expands under own name shipped views not overlaid · withdrawal saved in container copy misses shipped form name · expandUnderOwnName loader expandViewContainer mismatch

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — public forms | 缺项 (no item asserts a withdrawal saved in a package's stored copy reaches that package's shipped form) | P2

Triage: first grade — bug · security · priority:p2 · domain:engine · area:access · pm:blocked (finding removed). A stored copy of a container its package ships expands to the names the loaders gave that package. This amends my #21334 ruling 5946423948

Blocked-by: #21967

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T10:54Z. ⛔ Not a claim, ⛔ not a dispatch. Classes, positions and functions only.

Triage: lands in packages/metadata-protocol/src/protocol.ts (expandRuntimeViewContainer's cross-package branch, about :18316, and expandUnderOwnName, about :18419) ⇒ domain:engine; rationale: the runtime expansion names a package's stored copy differently from the loaders' names for the same package's shipped container.

Verified on main (dcf3eb494a):

• Both loaders expand a shipped container with expandViewContainer under the object's name, whichever package owns the object: objectql/src/engine.ts about :7159–:7165, and metadata/src/plugin.ts about :1198–:1210.
• The runtime expansion takes the own-name arm whenever isAnotherPackagesObject holds. So a package's stored copy of its own shipped container overlays none of that package's shipped views.

This amends my ruling 5946423948 on #21334. The ruling said a container on another package's object expands under its own name, so that it never writes a name another package owns. It did not separate a container the copying package itself ships. For that container, the loaders have already published the names, keyed to that package, and the copy must overlay them. The ruling's reason still holds: no expansion writes a name owned by another package. It is triage's ruling, so triage refines it; the maintainer can still overturn it.

Direction:

• A container the copying package ships: its stored copy expands to the same names the loaders gave that package's shipped views, keyed to that package. It relies on the per-package keying finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967 is landing.
• Any other container on another package's object: it keeps the own-name arm, unchanged.
• The seat's isDefault answer on metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334 (5955628428, OQ1) is unchanged.
• ⛔ The loaders' names do not change: a shipped view's name is published, and renaming it is a migration.
• ⛔ No new key.

Stop condition: if making the copy overlay its shipped names needs anything beyond #21967's per-package keying (a different by-name read, or a change to what the loaders register), the dev returns needs_decision, and the card goes to the maintainer's box.

Pins (this card closes the family; see below):

• An enumeration pin over every placement a stored copy can take. The object is owned by the same package, by another package, or by none. The container is shipped by the copying package or not. The member is the bare list, a keyed member, or a form.
• For each placement, a withdrawal saved in the copy is honoured at both anonymous doors, and the expansion never writes another package's name.
• metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's pins and finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967's pins stay green.

Why security and p2: a form that a package withdraws in its stored copy can still be served on the anonymous doors. Reaching it needs that package's stored copy, which is an administrator's act. That is the same reach as #21967, so the same grade.

Family. This is the withdrawal-reach family after #21835, #21934 and #21967. A third occurrence gets the closing card, so this card carries the enumeration pin above, not one case.

Why blocked: PR #21979 (#21967) edits the same list read and lands the per-package keying this direction relies on.

Prior rulings read: view container, expansion, own name, package, withdrawal → triage's #21334 ruling 5946423948 (amended above), the seat's 5955628428 (kept), ADR-0005's name-keyed overlays, ADR-0126 (no silent override); thread: #21334, #21639, #21967.

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — public forms | 缺项 | P2

Unlock: pm:blocked → pm:queue. #21967 landed the per-package keying this direction relies on

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T12:59Z. ⛔ Not a claim, ⛔ not a dispatch. Classes, positions and functions only.

• The blocker, verified: PR fix(metadata-protocol): another package's withdrawal of a form holds at the anonymous form endpoints, whatever packages' copies of a view container are saved #21979 merged as db87a025df, and finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967 closed completed (landing record 6015752210). The env-wide view list now serves each name-and-package slot through one selection, servedViewExpansion. resolveRowlessExpandedView selects through the same function.
• The direction stands as graded (6014736043):
  • a package's stored copy of a container it ships expands to the names the loaders gave that package, keyed to it, so servedViewExpansion sees it in that package's own slot;
  • any other container on another package's object keeps the own-name arm;
  • ⛔ the loaders' names do not change.
• The stop condition is unchanged: anything beyond the per-package keying that is now on main returns needs_decision.
• The enumeration pin over every placement is unchanged, and this card still closes the family.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 46 · 2026-10-06T13:05Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-21980-copy-overlays-shipped-names
Worktree: objectstack-issue-21980
Domain: domain:engine
Seat: domain:engine#1
Provenance: triage graded this card (6014736043), amending its own #21334 ruling 5946423948. It unlocked the card to pm:queue (6016790773) once #21967 landed through PR #21979 (db87a025df). It is the only eligible pm:queue card in this lane. The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」), and no dev slot is in use: PR #21990 (#21978) waits on CI. This seat filed the card from #21967's dev report, and it carries no withheld detail.
File surface (at origin/main aa09db58c9), per triage's direction 6014736043:

• packages/metadata-protocol/src/protocol.ts:
  • expandRuntimeViewContainer's cross-package branch (about :18540–:18568, isAnotherPackagesObject at :18641).
  • expandUnderOwnName (about :18669).
• A container the copying package ships: its stored copy expands to the same names the loaders gave that package's shipped views (expandViewContainer under the object's name, objectql/src/engine.ts:7159–:7165, metadata/src/plugin.ts:1198–:1210), keyed to that package, so servedViewExpansion sees it in that package's own slot.
• Any other container on another package's object: it keeps the own-name arm, unchanged.
• ⛔ The loaders' names do not change. ⛔ No new key. The seat's isDefault answer on metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334 (5955628428) is unchanged.
• Stop condition (triage): if the copy overlaying its shipped names needs anything beyond finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967's per-package keying (a different by-name read, or a change to what the loaders register), the dev returns needs_decision.
• Pins (this card closes the withdrawal-reach family):
  • An enumeration pin over every placement a stored copy can take:
    • the object is owned by the same package, by another package, or by none;
    • the container is shipped by the copying package or not;
    • the member is the bare list, a keyed member, or a form.
  • For each placement, a withdrawal saved in the copy is honoured at both anonymous doors, and the expansion never writes another package's name.
  • metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's and finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967's pins stay green.
  • Unit pins in metadata-protocol. One public dogfood case under packages/qa/dogfood/test/ only if a door-level pin is measured necessary, declared on [PM seat] domain:cli — 🟢 os-warren · session_01RWZbGvPFcRKvUqASZtunCU #6024.
• .changeset/21980-*.md (@objectstack/metadata-protocol patch).
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
  Clause-②: no (narrowing)
• Revised by the seat at 2026-10-06T16:29Z on the maintainer's ruling: batch 🔗 Broken links detected in documentation #282 item 1, decision card decision: #21980 OQ1 — the unscoped kernel's bare-name registration lets one package's stored copy answer another package's by-name read: fix it in #21980, split it out, or fix it first? #22004, pointer 6020226416, OQ2 → A. The claim first read no.
• The copy's new names narrow what the save door accepts in three edge shapes (the dev's report 6018023897, H3 a/b/c), each refused with 400 VALIDATION_ERROR where main accepted it.
• BREAKING: at least minor, a ! subject, and an ADR-0087 not-required (no-migration-prescription) marker, Two stored view containers of one object still displace each other's views: a container bound elsewhere or unbound under a sibling's expanded name, and a second container's bare list taking the first's <object>.default, are accepted with no diagnostic #21639's shape. The changeset notes that no census of the writers of such copies was taken. No exported declaration moves.
• The file surface also gains hydrateExpandedViewItems (OQ1 → A): it stops registering the bare name of an expansion whose name another package ships.
  Thread-read: 6016790773
  Serial constraints cleared: at 2026-10-06T13:05Z:
• Triage's serial finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967 closed completed through PR fix(metadata-protocol): another package's withdrawal of a form holds at the anonymous form endpoints, whatever packages' copies of a view container are saved #21979.
• Open PRs (fix(metadata-protocol): put and delete accept the version a checksum-less sys_metadata row is served as #21990, chore: version packages #21988, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974), each file list read by filename: none touches protocol.ts. This lane's PR fix(metadata-protocol): put and delete accept the version a checksum-less sys_metadata row is served as #21990 (finding(metadata-protocol): a sys_metadata row with no checksum cannot be edited or removed through the metadata door: the read hands out a computed version, and put / delete compare it against the raw null column (409 METADATA_CONFLICT) #21978) touches sys-metadata-repository.ts only.
• [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (sys-member.object.ts, decision box) shares no file with this card.