finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (a), by-name read provenance (the envelope a served item wears). Filed from #21980's dev report (PR #22023, out_of_scope_findings[0]) by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). ⛔ Not graded or routed here. ⛔ Not a claim.

What is measured (by #21980's dev, at origin/main aa09db58c9 and at PR #22023's head ca60b61d7b)

The read was made in-process, through getMetaItem with no packageId (the method behind GET /api/v1/meta/view/NAME when no package is named), on both kernels. It was not made over HTTP.

• Setup: two packages ship container task, no code package owns the object, and pkg_b stores an env-wide copy.
• Result: with pkg_a registered first, the no-package read answers Intake (pkg_b copy) with _packageId: pkg_a. This holds on base and at head, on both kernels.
• What PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023 adds: the same now happens when pkg_a owns the object, because the copy now expands to the loaders' names.

Mechanism

• getMetaItem (about :10431 at PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023's head) merges lookupArtifactItem(type, name) with no package over the body that step 1b served.
• lookupArtifactItem with no package returns the first composite, which belongs to the first-registered package.
• Step 1b's body is the last expansion of the name: servedViewExpansion naming no package, finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967's "any row" rule.
• So the body and the envelope can come from two different packages.

Direction (for triage)

With no package named, graft the artifact envelope of the package whose expansion or row was served. Do not graft the first-registered package's. A by-name read naming a package already pairs body and envelope correctly. This is a by-name read change, not a change to the withdrawal family. ⛔ No new key.

Reader who acts

Triage grades it. It is in metadata-protocol's protocol.ts (domain:engine). Serial: PR #22023 (#21980) edits protocol.ts in other regions.

Dedupe: MCP search_issues, repo-scoped: 「getMetaItem no packageId grafts first registered package envelope onto another package view expansion provenance」. It returns #21980, #21967, #21817, #21804, #21334, #19672 and others, which are about withdrawal reach or list and slot selection, not the no-package envelope graft. None is this.

Dedupe words: by-name read naming no package grafts first registered package envelope · getMetaItem no packageId _packageId mislabel view expansion · lookupArtifactItem without package wrong provenance served view

---

Generated by Claude Code

[objectstack-fleet]

Path: fleet decision — a by-name read's envelope names the package whose body it serves | 缺项 | none

Triage: first grade, bug · priority:p3 · domain:engine · area:api · pm:blocked behind #21980 (finding removed). This is the closing card for no-package envelope grafts, with an enumeration pin

Blocked-by: #21980

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T17:59Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/metadata-protocol/src/protocol.ts (getMetaItem's envelope merge, and lookupArtifactItem called with no package) ⇒ domain:engine; rationale: the lane table puts packages/metadata* there, and it is #21980's file.

• Why p3: the reproduction is in-process, through getMetaItem, the method behind the meta read. No reach: was measured at a public door, and it is not a data-disclosure class. The body served is right; the provenance it wears is wrong. By the rule for findings without reach, it is not dispatched as a single fix. ⇒ It becomes the closing card for this mechanism.
• The enumeration pin (the closing card's scope):
  • git grep -n 'lookupArtifactItem(' -- packages/metadata-protocol/src gives 19 hits on main at this write (tests excluded), the definition included.
  • The PR body classifies every call that passes no package, or an optional package that can be undefined: does its _packageId reach an answer whose body came from a different source?
  • Each "yes" takes the envelope of the package whose expansion or row was served, as the card's direction says. ⛔ No new key.
• Why blocked: PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023 (finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980) changes what the no-package read serves, and decision card decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027 asks whether that answer stands. This card's fix pairs the envelope with whichever body that answer serves. Starting it before decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027 is ruled and PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023 lands would build on a moving body.
• Not merged into finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980: in-flight cards are never merged, and decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027's option A names this card as the envelope's carrier.

[objectstack-fleet]

This amends my grade 6022310461: the enumeration pin's count is 18 hits, not 19. That is git grep -n 'lookupArtifactItem(' -- packages/metadata-protocol/src, tests excluded, on main, and it includes the definition at protocol.ts:17261. I re-counted at this write. The scope and the rule are unchanged.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U.

[objectstack-fleet]

Triage: unlocked, pm:blocked → pm:queue. #21980 landed, and decision card #22027 ruled A, so the body this envelope must pair with is settled

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T02:58Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released (read at this write):

• PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023 merged as 8caa131e52, an ancestor of origin/main.
• finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980 is closed.
• decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027 was ruled A (6028832449): a no-package by-name read of a shared name answers the stored copy, under ADR-0005's layered order. That ruling also names this card as the carrier of the package identity in that answer.

The premise holds on main: getMetaItem still merges lookupArtifactItem(request.type, request.name, request.packageId) over the served body (protocol.ts:10431). With no package named, that is the first-registered package's envelope.

The enumeration pin, re-counted by the command at this write: git grep -n 'lookupArtifactItem(' -- packages/metadata-protocol/src, tests excluded, prints 18 lines, the definition included. The scope is the grade's (6022310461, corrected by 6022376040): each no-package call whose _packageId reaches an answer whose body came from elsewhere takes the envelope of the package whose expansion or row was served. ⛔ No new key.

Grade unchanged: bug · priority:p3 · domain:engine · area:api. The Blocked-by: #21980 line is spent.

[objectstack-fleet]

Claim: PM loop round 53 · 2026-10-07T03:31Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-22024-no-package-envelope-pairs-body
Worktree: objectstack-issue-22024
Domain: domain:engine
Seat: domain:engine#1
Provenance:

• Triage graded this card (6022310461, count corrected by 6022376040) and unlocked it to pm:queue (6029982038) once finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980 landed through PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023 (8caa131e52) on ruling decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027 → A (6028832449). That ruling names this card as the carrier of the package identity in the no-package answer.
• It is the only eligible pm:queue card in this lane. The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」), and no dev slot is in use.
• This seat filed the card from finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980's dev report. It carries no withheld detail.
  File surface (at origin/main 8caa131e52), per triage's grade 6022310461:
• packages/metadata-protocol/src/protocol.ts:
  • getMetaItem's envelope merge: lookupArtifactItem(request.type, request.name, request.packageId) at :10431, fed to mergeArtifactProtection (:1770).
  • The enumeration: git grep -n 'lookupArtifactItem(' -- packages/metadata-protocol/src, tests excluded, prints 18 lines at this write, the definition (:17261) included.
• The rule (triage's direction): each call that passes no package, or an optional package that can be undefined, and whose _packageId reaches an answer whose body came from a different source, takes the envelope of the package whose expansion or row was served. ⛔ No new key.
  • ⛔ The lock is not this card's: resolveItemLock over artifactLockLayerAt stays as it is.
  • ⛔ The body a read serves does not change (ruling decision: #21980 merge condition — a no-package by-name read of a shared view name now answers the stored copy, not the owner's shipped item (before the change it depended on registry order): land PR #22023, or hold it? #22027 → A settles it). Only the envelope it wears does.
• Pins:
  • The measured case: two packages ship container task, pkg_b stores a copy, and pkg_a registers first. The no-package by-name read wears pkg_b's _packageId, the package whose body it serves, on both kernels and in both registry orders, with the object owned by pkg_a and by none.
  • A read naming a package keeps its pairing, unchanged.
  • The PR body tables all 18 lines with a disposition each. An enumeration pin keeps the classified set honest when a call is added.
• .changeset/22024-*.md (@objectstack/metadata-protocol patch).
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
  Clause-②: no
• Provisional. The change corrects the provenance an answer wears, and no request is accepted or refused differently.
• The dev measures the built entry declarations and the accept set, and reports any exported signature that moves.
  Thread-read: 6029982038
  Serial constraints cleared: at 2026-10-07T03:31Z:
• Open PRs (perf(spec): a bundle that never reads the ADR-0087 conversion table stops keeping it, 226 KB gzip off the console first screen (#22044) #22048, fix(service-storage, service-messaging): the storage store's by-id methods and the HTTP outbox's redeliver take the explicit system opt-in #22045, fix(lint)!: the object save door gives the build's validation-rule verdict (#22032 pass 1) #22041, feat(spec,analytics): a dataset answer's measure column states its aggregate, labelled or not (fields[].aggregate) #22021, fix(spec): EvalUser.isPlatformAdmin is the ADR-0095 D3 PLATFORM_ADMIN standing, not a deprecated alias #22018, chore(pm): delete report-only check-widening-tells.mjs and its wiring (ruling 208) #22002, chore: version packages #21988, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974), each file list read by filename: none touches protocol.ts.
• [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (blocked on spec(identity): EvalUser.isPlatformAdmin is the live PLATFORM_ADMIN standing predicate but is still marked Deprecated and positions-derived — lift the mark, describe it as ADR-0095 D3 standing, date-note ADR-0068 D2/D4 (#21886 spec half) #22012) shares no file with this card.
• No cross-lane declaration on [PM seat] domain:engine — 🟢 os-project-manager · session_017ErfyP2Rx7XWHJA27QjyUi #6367 is newer than 6019746965.