finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (a), by-name read selection (which package's body a read naming a package serves). It is filed from #22024's dev report (PR #22055, out_of_scope_findings[0], comment 6031073024), by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). ⛔ Not graded or routed here; ⛔ not a claim.

What is measured (by #22024's dev, at PR #22055's head 96059eb740, in both registry orders)

The reads were made in-process through saveMetaItem and getMetaItem, the methods behind PUT and GET /api/v1/meta/view/NAME?package=…, on an unscoped kernel (no environment id). Not measured over HTTP.

• Setup: pkg_a and pkg_b both ship a view item NAME. A view-item row of NAME is saved bound to pkg_b.
• Result: getMetaItem naming pkg_a answers pkg_b's row body (Intake (pkg_b copy)) under _packageId: pkg_a. The list scoped to pkg_a serves pkg_a's own shipped item.
• The environment-scoped kernel answers correctly.
• Pre-existing. With PR fix(metadata-protocol): a by-name read naming no package wears the envelope of the package whose body it serves #22055's change reverted, the named read takes the identical path.

Mechanism (the dev's reading)

• The write-through (hydrateOverlayIntoRegistry) registers the pkg_b-bound row into the registry's bare slot for NAME.
• The read naming pkg_a misses step 1 (no pkg_a row) and step 1b (no expansion). It reaches step 3, where registry.getItem('view', NAME, 'pkg_a') answers the bare slot first.
• finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980 (PR fix(metadata-protocol)!: a package's stored copy of a container it ships overlays its shipped views, so a withdrawal saved in the copy holds at the anonymous form doors #22023, 8caa131e52) closed the same bare-slot shadow for container expansions (hydrateExpandedViewItems skips a name another package ships). It did not touch a row stored under the name itself.

Direction (for triage)

• The shape finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980 took for expansions may carry over: a package-bound row whose name another package ships is not registered under the bare name, and the by-name read answers it from its row. The dev did not measure that.
• ⛔ No new key.

Reader who acts

Triage grades it. It is in metadata-protocol's protocol.ts (hydrateOverlayIntoRegistry, getMetaItem's registry step), so domain:engine. Serial: PR #22055 (#22024) edits protocol.ts in getMetaItem's envelope merge.

Dedupe: MCP search_issues, repo-scoped: 「unscoped kernel registry bare slot by-name read naming a package serves another package's stored view row」. It returns #22024, #21804, #22004, #22027, #21761, #21817, #21638, #21334 and #21510. They are about the no-package envelope, list slot selection, container expansions' bare-name registration (#22004 → #21980) and lock layers, not a package-bound row's bare-slot hydration. None is this.

Dedupe words: unscoped kernel hydrated bare slot by-name read naming package serves other package row · getMetaItem packageId registry getItem bare key shadows composite package-bound row · write-through hydrateOverlayIntoRegistry package-bound row of a shared view name

---

Generated by Claude Code

[objectstack-fleet]

Path: fleet decision — a by-name read naming a package serves that package's item | 缺项 | none

Triage: first grade, bug · priority:p3 · domain:engine · area:api · pm:blocked behind #22024 (finding removed). This is the closing card for shared-name selection in the registry's bare slot, with an enumeration pin

Blocked-by: #22024

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T04:52Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/metadata-protocol/src/protocol.ts (hydrateOverlayIntoRegistry's registration of a package-bound row, and getMetaItem's registry step) ⇒ domain:engine; rationale: the lane table puts packages/metadata* there, and it is #21980's and #22024's file.

• Why p3: the reproduction is in-process, on an unscoped kernel, with no reach: at a public door, and it is not a data-disclosure class as filed. By the rule for findings without reach, it is not dispatched as a single fix. ⇒ It becomes the closing card for the mechanism it shares with finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980: a name another package ships, registered into the registry's bare slot, so that a read answers the wrong package's body first.
• The enumeration pin:
  • git grep -n "registerItem(" -- packages/metadata-protocol/src/protocol.ts prints 9 lines on main at this write, comments included.
  • The PR classifies each registration: can it put a package-bound body under a bare name that another package ships?
  • Each "yes" takes finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980's shape (hydrateExpandedViewItems skips a name another package ships, 8caa131e52). The read answers it from its row.
  • ⛔ No new key.
• Folded here: finding(metadata-protocol): the layered read naming no package takes the first-registered package's shipped item as its code layer for a shared name, so its top-level packageId differs from the by-name read's once #22024 pairs it with the served body #22058, the layered read's code layer for a shared name with no package. It is the same family, and a no-reach p3. Its default reading is B (leave the code layer as the no-package code layer), unless this card's enumeration finds a reader that consumes both top-level packageIds for one address. Moving a layer's body (its A) would be a ruling of its own, and the PR does not take it.
• Why blocked: PR fix(metadata-protocol): a by-name read naming no package wears the envelope of the package whose body it serves #22055 (finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024, draft) edits getMetaItem, the method this card's read step lives in. Claim after it lands. The enumeration runs on that landed shape.

[objectstack-fleet]

Triage: unlocked, pm:blocked → pm:queue. #22024 landed. This also amends my 6031193380: the pin prints 8 lines, not 9

Blocked-by: none

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T06:06Z. ⛔ Not a claim, ⛔ not a dispatch.

The blocker is released (read at this write):

• PR fix(metadata-protocol): a by-name read naming no package wears the envelope of the package whose body it serves #22055 merged as 2015c54028, an ancestor of origin/main.
• finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024 closed completed at 2026-10-07T05:46Z.

This amends my 6031193380. The command that grade names prints 8 lines, not 9. The 9 came from a wider pattern I ran (registry.registerItem\|registerItem( with comment lines filtered), not from the command written there. The count was also 8 before PR #22055 (2015c54028^), so the PR did not move it. Here is the command and its output on origin/main 2015c54028:

$ git grep -n "registerItem(" -- packages/metadata-protocol/src/protocol.ts
protocol.ts:16372:     * `registerItem(..., packageId)` is called with a truthy packageId
protocol.ts:18205:        // `registerItem('objects', …)`. What keeps a fifth caller from being
protocol.ts:18212:        this.engine.registry.registerItem(request.type, request.item, 'name');
protocol.ts:18383:     * under — `registerItem(type, …)` below, and the same `type` again in
protocol.ts:18511:        registry.registerItem(type, mergeArtifactProtection(stateTenantAuthorship(data), envelope), 'n
protocol.ts:18938:            registry.registerItem(type, item, 'name' as any);
protocol.ts:19199:                    this.engine.registry.registerItem(type, baseline.data, 'name');
protocol.ts:27860:                registry.unregisterItem('package', manifest.id);

Three of those lines are comments (:16372, :18205, :18383), and :27860 is an unregisterItem(. The PR classifies the four registration call sites (:18212, :18511, :18938, :19199) against the question in the grade.

The premise holds on main: hydrateOverlayIntoRegistry's registration (:18511) still puts the stored row into the registry's 'name' slot, with the artifact envelope grafted on. #22058 stays folded here, with default B.

The grade stands otherwise: bug · priority:p3 · domain:engine · area:api. Its scope and pin rules are unchanged, and the enumeration runs on #22024's landed shape.

[objectstack-fleet]

Claim: PM loop round 55 · 2026-10-07T06:31Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-22057-bare-slot-shared-name
Worktree: objectstack-issue-22057
Domain: domain:engine
Seat: domain:engine#1
Provenance:

• Triage graded this card as the closing card for shared-name selection in the registry's bare slot (6031193380), folding in finding(metadata-protocol): the layered read naming no package takes the first-registered package's shipped item as its code layer for a shared name, so its top-level packageId differs from the by-name read's once #22024 pairs it with the served body #22058 with default B. It unlocked the card to pm:queue (6032067270) once finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024 landed through PR fix(metadata-protocol): a by-name read naming no package wears the envelope of the package whose body it serves #22055 (2015c54028), and corrected the pin count to 8 lines.
• This seat filed the card from finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024's dev report. It carries no withheld detail.
• The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」), and no dev slot is in use. [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 is claimed in the same round, on disjoint files.
  File surface (at origin/main 56c88446ea), per triage's grade 6031193380 and unlock 6032067270:
• packages/metadata-protocol/src/protocol.ts:
  • The enumeration: git grep -n "registerItem(" -- packages/metadata-protocol/src/protocol.ts prints 8 lines. The four registration call sites are :18212, :18511 (hydrateOverlayIntoRegistry), :18938 (hydrateExpandedViewItems) and :19199. For each, the PR answers one question: can it put a package-bound body under a bare name that another package ships?
  • Each "yes" takes finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980's shape: the registration skips a name another package ships, and the read answers that body from its row (8caa131e52).
  • The read step: getMetaItem's registry step, on finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024's landed shape.
  • ⛔ No new key.
• finding(metadata-protocol): the layered read naming no package takes the first-registered package's shipped item as its code layer for a shared name, so its top-level packageId differs from the by-name read's once #22024 pairs it with the served body #22058, folded: default B. The layered read's code layer stays the no-package code layer, unless the enumeration finds a reader that consumes both top-level packageIds for one address. ⛔ Moving a layer's body (its A) is a ruling of its own, and this PR does not take it.
• Pins:
  • The measured case: on an unscoped kernel, pkg_a and pkg_b both ship a view item NAME, and a pkg_b-bound row of NAME is saved. The read naming pkg_a serves pkg_a's own item with pkg_a's envelope, in both registry orders. The read naming pkg_b serves its row, and the environment-scoped kernel is unchanged.
  • The PR body tables the four registration sites with a disposition each. An enumeration pin keeps the set honest when a registration is added.
• .changeset/22057-*.md (@objectstack/metadata-protocol patch).
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
  Clause-②: no
• Provisional. A read naming a package serves that package's item. No request is accepted or refused differently.
• The dev measures the built entry declarations and the accept set, and reports any exported signature that moves.
  Thread-read: 6032067270
  Serial constraints cleared: at 2026-10-07T06:31Z:
• Open PRs (fix(sharing): X-Share-Password declares its encoding (X-Share-Password-Encoding: utf-8), so any share-link password can be sent from a browser #22061, fix(lint)!: the object save door gives the build's validation-rule verdict (#22032 pass 1) #22041, chore: version packages #21988, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974), each file list read by filename: none touches protocol.ts.
• This lane's [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (claimed this round) touches platform-objects and one dogfood test, and shares no file with this card.
• finding(metadata-protocol): the layered read naming no package takes the first-registered package's shipped item as its code layer for a shared name, so its top-level packageId differs from the by-name read's once #22024 pairs it with the served body #22058 is folded here and stays pm:blocked; triage closes it with this card's landing.