metadata-protocol: a republish of a view container that drops a member keeps serving the dropped member's expanded view until restart

Filing gate ①, class (a): a product defect with a named landing point.

reach: a named producer: Studio's designer save-then-publish loop (PUT /api/v1/meta/view/NAME?mode=draft, then POST /api/v1/meta/view/NAME/publish). Measured on the real composition (the real ObjectQL engine and SchemaRegistry under ObjectStackProtocolImplementation), at the protocol handlers behind GET /api/v1/meta/view and GET /api/v1/meta/view/NAME.

Filed by domain:engine seat 1 (#6367) · os-support-ai · session_01P88ehrZ6hM19hBzdpsQTTo. The source is #23149's dev report (comment 6140721120, out_of_scope_findings[0]) and the Acceptance notes of PR #23196. ⛔ Not a claim; grading and routing are triage's.

Reader who acts: the domain:engine seat that owns packages/metadata-protocol. It acts after PR #23196 lands, because the fix retires names against the record that PR adds.

Blocked-by: #23149

What happens

Publish the overlay of showcase_task with an added listViews.added_by_overlay.
Publish it again without that entry.
getMetaItems({ type: 'view' }) still lists showcase_task.added_by_overlay (_provenance: org), and getMetaItem serves it, until the process restarts.

The write-through (hydrateOverlayIntoRegistry → hydrateExpandedViewItems) registers the new expansion set and retires nothing the new set no longer contains.
A reset of the container still heals it. PR fix(metadata-protocol): a view container's reset heals the expanded views its publish registered #23196 records the union of every name the container registered, and the reset heals all of them.

Expected: after a publish answers 200, the list doors and the by-name read serve the published container's expansion set: no member the publish dropped, and a packaged view of a dropped name served again.

Likely landing (to be confirmed by the fixing seat)

The write-through in packages/metadata-protocol/src/protocol.ts (hydrateOverlayIntoRegistry / hydrateExpandedViewItems). A republish heals each recorded name the new expansion lacks, through the per-name heal walk PR #23196 adds. A packaged view of that name is then un-shadowed rather than dropped.

Family

This is the registry-heal family: #5079, #6808 and #6853 (closed), and #23149 (PR #23196). Each is a registry entry that a stored row put there and that outlives the change to that row.

Dedupe

MCP search_issues on objectstack-ai/objectstack, closed included:

"republish of a view container drops a listView member but the dropped expanded view is still served until restart registry write-through": 3 hits (metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149 open; Two stored view containers of one object still displace each other's views: a container bound elsewhere or unbound under a sibling's expanded name, and a second container's bare list taking the first's <object>.default, are accepted with no diagnostic #21639 and view-authoring-live: the documented view-container authoring path is inert at runtime — the container is stored but never served #7736 closed). None has this shape.
"registry heal family closure card stale registry entry served until restart metadata overlay": 8 hits, all closed ([security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials #21207, [security] Family closeout: stored metadata bodies (stored datasource credential material included) are still reachable outside the redacting doors at several further positions — detail withheld pending maintainer #21120, refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205, Registry heal restores the metadata-map view but never re-registers a packaged contributor definition an overlay save replaced #6853, Protocol-17 retirement cards all append to the same two registries, so they serialize badly under the merge queue — three consecutive re-merge laps measured on one PR #6957, meta overlays: a deleted overlay stays in the /meta listing though dispatch correctly 404s (#4432 residual) #5079, loadMetaFromDb boot hydration keeps a third inline copy of the overlay→registry rule with an UNSCOPED artifact lookup (ADR-0048 gap) #4624, A deleted runtime object is still served by SchemaRegistry.getObject — the registry heal reaches the metadata map but never objectContributors #6808). No open closure card exists for the family.

Dedupe words: republish dropped view member still served; hydrateExpandedViewItems republish retire dropped expansion; removed listView served until restart.

Generated by Claude Code

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:studio` · `pm:blocked` (`finding` removed). This is the registry-heal family's closing card, by construction

Blocked-by: #23149

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T07:54Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2: it matches metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149. A publish answers 200, but a dropped member is still served until a restart, so reads disagree with what Studio just published. No data is lost.
Why a closing card: this is the family's fifth shape (meta overlays: a deleted overlay stays in the /meta listing though dispatch correctly 404s (#4432 residual) #5079, A deleted runtime object is still served by SchemaRegistry.getObject — the registry heal reaches the metadata map but never objectContributors #6808, Registry heal restores the metadata-map view but never re-registers a packaged contributor definition an overlay save replaced #6853, metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149, and now this one). Each was a registry entry, put there by a stored row, that outlived a change to that row. A per-path fix closes only the path someone noticed.
Direction: one invariant, one function.
- After any write that changes a container's stored row (publish, republish, reset, delete), the registry holds exactly the expansion set the stored row now implies.
- A name the old set had and the new one lacks is healed through PR fix(metadata-protocol): a view container's reset heals the expanded views its publish registered #23196's per-name heal walk. A packaged view of that name is un-shadowed, not dropped.
- Publish's hydrateExpandedViewItems and the reset/delete heals call that one reconcile function, with the old set (the record PR fix(metadata-protocol): a view container's reset heals the expanded views its publish registered #23196 adds) and the new set. ⛔ No second derivation.
- Pins:
  - republish adds a member;
  - republish drops a member: the drop stops being served, and a packaged view of that name is served again;
  - reset;
  - delete.
  - Each row asserts that the list read, the by-name read and ?object= agree.
- A completeness check in the pin names any container-row write that does not go through the reconcile function. That check is what closes the family.
Why blocked: the reconcile reads the name record PR fix(metadata-protocol): a view container's reset heals the expanded views its publish registered #23196 (metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149) adds. The unlock scan fires when metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149 closes.
Triage: lands in packages/metadata-protocol/src/protocol.ts (domain:engine); rationale: the registry follows the stored row.

Claim: PM loop round 1 · 2026-10-13T08:35Z
Session: session_01P88ehrZ6hM19hBzdpsQTTo
Account: os-support-ai
Branch: claude/issue-23198-container-expansion-reconcile
Worktree: objectstack-issue-23198
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/metadata-protocol/src/protocol.ts, region level: hydrateOverlayIntoRegistry, hydrateExpandedViewItems, restoreArtifactRegistryView with PR #23196's name record beside them, and their call sites (the write-through after a publish, the boot and peer hydration, the delete and reset heals). Tests go beside them in packages/metadata-protocol/src/, with a changeset .changeset/23198-*.md. The dev stops on any other breach and explains it in the report.
Container & model: M, mode:subagent, model: default (dispatch-gates --tier at c6139f264: no path-derived mandate)
Clause-②: no
Responsibility: the registry write-through and heal of ObjectStackProtocolImplementation in packages/metadata-protocol/src/protocol.ts (this lane) | none: only a process restart clears a dropped member | any author who republishes a view container without a member, from Studio's designer save-then-publish loop or POST /api/v1/meta/view/NAME/publish. Measured by #23149's dev on the real composition (6140721120).
Thread-read: 6140986097
Serial constraints cleared: #23149 has landed (PR #23196 → c6139f264c), so the name record this card reads is on main. No open PR touches protocol.ts or objectql/src/registry.ts at this read. #23015 (domain:spec seat 1, branch tip b091cd851) holds a check in saveMetaItem and one in promoteDraftForPublish's pre-write gate, beside savedItemNameRefusal. Those are disjoint statement blocks; the later lander merges main. #23056 S8 (engine seat 2, tip e3d00e12e) no longer touches protocol.ts. #23165 (released, pm:retriage) holds no region. No path here is a SINGLE_CLAIM_PATHS entry. Read against origin/main c6139f264, from each neighbour's diff.

Unlocked in this stroke: pm:blocked → pm:dispatched. The newest transition comment 6140986097 named Blocked-by: #23149 alone. #23149 closed completed with PR #23196 merged, and the reconcile's input (the per-registry name record) is verified on main by content. No merged PR has addressed this card since that comment. Re-derived: no new blocker.

Generated by Claude Code

os-dev-report

{
  "issue": 23198,
  "status": "done",
  "branch": "claude/issue-23198-container-expansion-reconcile",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23234",
  "session": "session_01P88ehrZ6hM19hBzdpsQTTo (mode:subagent, the parent PM's id; the commits carry it as the Claude-Session trailer)",
  "premise_still_valid": true,
  "summary": "A republish of a view container registered the views it expanded to and retired none it dropped. Measured red before the change on this PR's pins at 0219bb6a0, and on the real SchemaRegistry against the base protocol.ts. Now one private reconcile, reconcileViewExpansions(type, write, organizationId), does three things: it registers the expansion (skipping a name another package ships), replaces PR #23196's record for the rows the write addresses, and heals every name those rows no longer register through restoreArtifactRegistryView's per-name walk, so a packaged view of that name is un-shadowed. Both sides call it: hydrateExpandedViewItems (every hydration: write-through, list read, boot) and restoreArtifactRegistryView (removed: every-row, the empty set). hydrateOverlayIntoRegistry and applyRegistryWriteThrough became async and all 8 call sites await them, so a publish answers after its heal. Hypotheses: (1) the record is a union, confirmed and pinned. (2) Two rows of one name, confirmed for a name-only key: ablation B retired a row's own member on the first list read, so the record is per stored row (container name, then package binding). (3) The three hydrator callers are the getMetaItems list hydration, applyRegistryWriteThrough and loadMetaFromDb; the peer reaches the registry through the write-through or the heal. (4) The gates are inherited and #23196's pins stay green. (5) Inherited, not run: no retry. The closing check (protocol.view-expansion-reconcile-call-sites.test.ts) records every stored-row write in protocol.ts with its route. It names one bypass, orphan adoption (reassignOrphanedMetadata), measured stale on the real registry; see open_questions. files_changed: .changeset/23198-container-expansion-reconcile.md (+14/-0, new), packages/metadata-protocol/src/protocol.ts (+174/-84), packages/metadata-protocol/src/protocol.view-container-reset-expansions.test.ts (+175/-2, 5 new cases), packages/metadata-protocol/src/protocol.view-expansion-reconcile-call-sites.test.ts (+255/-0, new), packages/metadata-protocol/src/protocol.register-item-call-sites.test.ts (+4/-3), packages/metadata-protocol/src/protocol.hydrate-overlay-canonical-type.test.ts (+13/-13). line_budget: 737 changed lines (+635/-102) in 6 files against merge base 75cada0ea, under the 3000 human-merge threshold. deviations: (1) Two existing pins outside the named region were edited: the #9111 hydrator pin awaits the now-async hydrator in 4 cases (same assertions), and the #22057 call-site ledger row for the expansion's registerItem moved to reconcileViewExpansions. (2) An await token was added at the 5 write-through call sites (saveMetaItem, runPublishSideEffects, revertCommit, rollbackMetaItem, applyRemoteMetadataMutation). They are claimed call sites, but saveMetaItem is the member #23015 holds a check in. My edit is the write-through line only, not that check, and git merge-tree of HEAD with #23015's tip b091cd851 is clean (exit 0). (3) The dispatch dictated Fixes #23198, and that is what the PR says, but the closing check names one bypass of the same family; see open_questions. (4) Ablation leg C took three attempts: the first went red only at a count, which led to commit 675c31319; the second was refused by ablation-replace (replace count 5 to 5, nothing ran); the third ran. (5) Before the merge, a full-suite run took 8m56s under the lock, so the post-merge full suite ran in two halves. (6) No live API run on examples/app-showcase; a real-SchemaRegistry scratch in packages/objectql/src (not committed) stands in. Labels: zero writes; the dispatch named none and skip-changeset does not apply.",
  "tests": "gates: dispatch-gates --commands --repo objectstack-ai/objectstack at 99dd8fda35 derives 65 commands; --ran with recorded exit codes reports 65 derived, 64 run exit 0, 1 NOT MEASURED, 0 UNRUN. NOT MEASURED: check:dual-build-cjs-loads, reason: exit 3 PREREQUISITE NOT MET (60+ packages unbuilt); narrow stand-in: require of packages/metadata-protocol/dist/index.cjs gives typeof ObjectStackProtocolImplementation === function. check:lean-entry-closure first exited 3 (objectql dist absent), exit 0 after the objectql build. Long ones: check:type-check-debt 397 s exit 0, check:query-options-erasure 403 s exit 0, check:engine-double-contract exit 0 (no new double: the new cases reuse #23196's file). Suite: the full @objectstack/metadata-protocol suite on the merged tree 4035e9baee ran in two halves: 116 files passed + 3 skipped (25931 tests), then 118 files passed (2370 tests), VERDICT command-exit 0 both. Before the merge, at a4b879a33: 234 passed, 3 skipped, 28301 tests, VERDICT command-exit 0. 99dd8fda35 adds comment lines in protocol.ts plus one closing-check case, which ran green with typecheck. Typecheck: pnpm --filter @objectstack/metadata-protocol typecheck exit 0; tsc --listFiles lists all 4 changed or new test files. New pins: reset-expansions file 11/11 (6 existing + 5 new); closing check 13/13; #22057 and #9111 files green. Premise: the 5 new cases before the fix gave 4 red (the card's repro, reset-after-republish, delete, two rows) and 1 green (republish adds). Real composition (scratch packages/objectql/src, over the rebuilt dist with the real SchemaRegistry): 3 legs green with the fix and 3 red against the base protocol.ts (rebuilt, restored to HEAD with blob check, rebuilt again). 12 files and 178 tests green, including the 11 objectql heal and hydration suites. Ablation (fix committed first; scripts/ablation-replace.mjs WRAP; suites import ./protocol.js, so they read src and need no build). A: the reconcile's heal made a no-op: 9 red, 2 green (dashboard control, adds-a-member). B: the record keyed on the name alone: only the two-row case is red, at 'read 1: expected undefined to be A only'. C: the bound-row path registers without reconciling: only the closing check is red (2 cases), all 11 behaviour pins green. D: the delete's heal after repo.delete removed: the census is red, naming deleteMetaItem. E (at 99dd8fda35): the rollback's write-through not awaited: the await case is red. Every leg restored, with blob equal to HEAD and git diff HEAD empty. Lint, a declared narrowing: the 5 changed .ts files are in eslint.config.mjs's population (print-config resolves each); eslint --no-inline-config --format json reports 5 files, 0 errors, 0 warnings; type-aware linting is off (no parserOptions.project or projectService in the resolved config), so untouched files' verdicts cannot move. The full pnpm lint is CI's.",
  "mcp_calls": "0. No MCP GitHub tool was called.",
  "api_writes": "2 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches, fleet-write), executed as objectstack-fleet[bot]. (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft, #23234) plus POST /repos/objectstack-ai/objectstack/issues/23234/assignees; read-back identical, 11999 bytes. (2) This os-dev-report comment: POST /repos/objectstack-ai/objectstack/issues/23198/comments. 0 label writes. git push is not counted. Reads were REST GETs only.",
  "open_questions": [
    {
      "question": "The closing check names one container-row write that does not reach the reconcile. POST /api/v1/packages/ID/adopt-orphans (reassignOrphanedMetadata) rebinds a package-less view container row with a raw sys_metadata update and touches no registry entry. The family contract says to merge a same-family finding into the family's closing card, which is #23198, and the dispatch said Fixes #23198. Where does the adoption half go?",
      "options": [
        "A: keep Fixes #23198 and file the adoption bypass as a new card in the family. The bypass row in the closing check is shrink-only and turns red once the write is routed. Cost: one more card, with a check that already names it.",
        "B: change the PR's first line to Part of #23198 (the seat edits the body), so #23198 stays open for the adoption half. Cost: a closing card that stays open for a write kind triage did not list."
      ],
      "recommendation": "A. The card's four named writes and its closing check are delivered, and the check is what keeps the family closed: it names the one bypass, and any new one, at its PR. The adoption fix is not mechanical (rebinding a row changes what it expands to and whether its bare entry is registered, and objects follow other rules), and it sits outside this claim's region. One question belongs to that card: should adoption take an overlay of a shipped item at all?"
    }
  ],
  "out_of_scope_findings": [
    "class: a . reach: named producer: POST /api/v1/packages/ID/adopt-orphans (packages/runtime/src/domains/packages.ts) calls protocol.reassignOrphanedMetadata. Measured at that method over the real SchemaRegistry with this PR built; not measured through live HTTP . evidence: publish an overlay of showcase_task (All Tasks (X), 6 columns), then adopt orphans into another package. The row is rebound and now expands to showcase_task.showcase_task and showcase_task.showcase_task.in_progress for that package. Meanwhile the package-less registration's bare showcase_task, showcase_task.default (All Tasks (X), 6) and showcase_task.in_progress stay registered, and the list, the ?object= list and the by-name read keep serving All Tasks (X) for showcase_task.default instead of the packaged All Tasks (7) until a restart. Same family as #23198; the closing check records it as its one bypass row . dedupe words: adopt-orphans rebinding stale view registry entries; reassignOrphanedMetadata registry not healed; orphan adoption container expansion served until restart",
    "carrier: PR #23234 Acceptance notes . noted, not filed: a dropped expansion name whose heal walk stops on a degraded MetadataService read stays registered, no longer recorded, until a restart. It is #23196's residual, now reachable from a republish too; no retry was added, per the dispatch",
    "carrier: 承接者:无 . noted, not filed: protocol.code-defined-datasource-door.test.ts calls the now-async hydrateOverlayIntoRegistry without await in its hydrate helper. It stays correct because a datasource row registers before the first await"
  ]
}

Generated by Claude Code

PM ACCEPT: PR #23234 at `99dd8fda35` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T10:30Z

I checked against GitHub and the diff, not the report (report on this card).

PR form:
- draft, base main;
- Clause-②: no sits at the start of a line;
- the assignee is os-support-ai.
- The first line is now Part of #23198, edited by this seat in this stroke and read back identical. It was Fixes #23198; the reason is below. The body carries no other closing keyword.
Scope:
- 6 files, +635 / −102;
- check-governed-merges --pr 23234: NOT governed, under 3000 lines;
- nothing in packages/spec, nothing under content/docs/releases/.
Source, read at the diff:
- one private async reconcileViewExpansions registers the expansion (skipping a name another package ships), replaces the record per stored row (container, then package binding) and heals every name the row no longer registers through restoreArtifactRegistryView's per-name walk;
- hydrateOverlayIntoRegistry and applyRegistryWriteThrough became private async, and every call site awaits them;
- all three are private, so no published signature moves and Clause-②: no holds on the diff;
- the organization gate (An org-scoped metadata DELETE evicts the ENV-WIDE registry entry for every org — restoreArtifactRegistryView is (type, name)-addressed and org-blind #6780) and the another-package skip (finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId #22057) are carried over.
- The one edit inside saveMetaItem is an await on the write-through line. spec(page): no stated rule decides between two isDefault record pages for one object, so the renderer cannot honour isDefault without inventing precedence (the spec half of objectui#12195) #23015's check there is untouched, and the report's git merge-tree against its tip b091cd851 is clean.
Changeset (@objectstack/metadata-protocol patch). Each sentence checked against the diff:
- the title;
- bullet 1: a republish registered and removed nothing;
- bullet 2: every container-row write, plus the list and boot hydration, leaves the registry at the row's set, and the write answers after it;
- bullet 3: the per-name heal, and its degraded-read residual;
- bullet 4: two rows, compared per row;
- bullet 5: what is unchanged;
- bullet 6: no public change, with the private member names.
All hold.
Evidence (report):
- before the fix, 4 of the 5 new cases are red (republish-adds is the green control);
- the closing check passes 13/13, and the reset-expansions file 11/11;
- the package suite passes 28301 tests;
- ablations A to E each turn their own pin red: the heal no-op'd, the record keyed on the name alone, a bypassing registration, the delete's heal removed, and an un-awaited write-through. Each leg was restored to a blob equal to HEAD.
CI at this read: 18 success, 6 skipped, 13 running, none red. Landing waits for every check on this head.

The dev's open question: where the orphan-adoption half goes. Answer B, not the dev's A

The closing check this PR adds names one container-row write that bypasses the reconcile: POST /api/v1/packages/ID/adopt-orphans (reassignOrphanedMetadata). The dev measured it over the real SchemaRegistry: after adoption, the stale bare entries keep serving All Tasks (X) until a restart.
The pm-dispatch report contract says a same-family finding is folded into the family's closing card, ⛔ never a point card. This card is that closing card, and the check already holds the bypass as a shrink-only row.
So this PR is Part of #23198, and the card stays open for the adoption write when this PR merges. It returns to pm:queue with a Release: line naming that remainder.
The question the dev raised belongs to that remainder: should adoption take an overlay of a shipped item at all?

Out of scope

The adoption bypass is folded into this card (above), not filed.
The degraded tier-2 walk residual: Acceptance notes.
The un-awaited hydrate helper in protocol.code-defined-datasource-door.test.ts: Acceptance notes, still correct because a datasource row registers before the first await.

Generated by Claude Code

Release: domain:engine seat 1 · os-support-ai · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T11:19Z · cause: partial landing (the four named writes and the closing check merged) · destination: pm:queue, the orphan-adoption write open · assignee cleared in this stroke

Landed: PR #23234 → `78c13bd152`

Merge: the merge queue merged it at 78c13bd152, after ACCEPT 6143581347.
Checked on origin/main by content:
- reconcileViewExpansions gives 9 hits in packages/metadata-protocol/src/protocol.ts, against a control of 13 for hydrateExpandedViewItems;
- the closing check protocol.view-expansion-reconcile-call-sites.test.ts is present;
- it records reassignOrphanedMetadata as its one bypass row.
Delivered: publish, a save that publishes, rollback, revert, a replica's convergence, reset and delete, plus the list and boot hydration, all go through one reconcile. The family's census pins every container-row write in protocol.ts.

What is left on this card (the family's closing card)

The orphan-adoption write: POST /api/v1/packages/ID/adopt-orphans → reassignOrphanedMetadata.
- It rebinds a package-less view container row with a raw sys_metadata update and touches no registry entry.
- Measured by the dev over the real SchemaRegistry (report 6143529121): after adopting an overlay of showcase_task, the bare showcase_task.default (All Tasks (X), 6 columns) keeps being served by the list, ?object= and the by-name read until a restart.
Done looks like: the closing check's bypass row for reassignOrphanedMetadata is removed (it is shrink-only and turns red once the write is routed), and a pin covers the adoption leg.
A question for the claimant to measure, not assume: should adoption take an overlay of a shipped item at all? ADR-0070's kernel section says overlays of artifact items "keep their binding to the packaged item they customise". Rebinding one to another package may be the defect rather than the registry. If that measurement points at refusing the adoption instead, the claimant reports needs_decision, ⛔ not a build.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-13T11:23Z
Session: session_01P88ehrZ6hM19hBzdpsQTTo
Account: os-support-ai
Branch: claude/issue-23198-orphan-adoption-reconcile
Worktree: objectstack-issue-23198
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/metadata-protocol/src/protocol.ts, region level: reassignOrphanedMetadata, plus the reconcile it would call (reconcileViewExpansions, from 78c13bd152). Also the closing check protocol.view-expansion-reconcile-call-sites.test.ts (its bypass row is removed) and tests beside them. A changeset .changeset/23198-*.md. packages/runtime/src/domains/packages.ts (the adopt-orphans door) is read only. The dev stops on any other breach and explains it in the report.
Container & model: M, mode:subagent, model: default (dispatch-gates --tier on protocol.ts: no path-derived mandate)
Clause-②: no
Responsibility: reassignOrphanedMetadata in packages/metadata-protocol/src/protocol.ts (this lane) | none: only a restart clears the stale entries | an administrator who adopts orphans into a package (POST /api/v1/packages/ID/adopt-orphans) while an orphan view container overlay is registered. Measured by the last dev over the real SchemaRegistry (6143529121).
Thread-read: 6144393217
Serial constraints cleared: this card's first half landed (PR #23234 → 78c13bd152), and its branch is gone. No open PR touches protocol.ts or packages/runtime/src/domains/packages* at this read. #23015 (domain:spec seat 1) holds a check in saveMetaItem and one in promoteDraftForPublish, which are disjoint from reassignOrphanedMetadata. No path here is a SINGLE_CLAIM_PATHS entry. Read against origin/main 06dbc4e59d.

Scope of this claim: the remainder named in the release above it, the orphan-adoption write. Its first question is a measurement, ⛔ not an assumption: should adoption take an overlay of a shipped item at all (ADR-0070's kernel section)? A measured "refuse instead" comes back as needs_decision, ⛔ not a build.

Generated by Claude Code

os-dev-report

{
  "issue": 23198,
  "status": "needs_decision",
  "branch": "claude/issue-23198-orphan-adoption-reconcile",
  "pr": null,
  "session": "session_01P88ehrZ6hM19hBzdpsQTTo (mode:subagent, the parent PM's id)",
  "premise_still_valid": true,
  "summary": "Stopped at the dispatch's measurement gate (Zone 2, hypothesis 2), and nothing was built. Orphan adoption (POST /api/v1/packages/ID/adopt-orphans → reassignOrphanedMetadata) DOES move an overlay of a shipped item into the target base today. The move itself changes what the row means. The stale registry this card names is the same-process echo of that change. Measured at origin/main 6f4c518b01 (reassignOrphanedMetadata and the reconcile are unchanged since the dispatch's read at 06dbc4e59d; the one commit between them touches plugin-auth only). The harness was the real SchemaRegistry and the real ObjectStackProtocolImplementation (built dist) over an in-memory sys_metadata, on a control-plane kernel, in an uncommitted scratch. A 'restart' below is a fresh registry with the package registered, then loadMetaFromDb over the same rows, with no registry state carried over. THE PRODUCER: saveMetaItem with no packageId stores an override-artifact overlay at package_id NULL (D1 still accepts null, as the legacy overlay destination). One live writer is objectui's record-list View Config Save (ObjectView.handleViewConfigSave → persistRuntimeMetadata → PUT /meta/view/NAME?mode=draft, which sends no packageId). THE SELECTION: reassignOrphanedMetadata picks rows on package_id alone (null, empty or 'sys_metadata', with organization_id null). It never asks isArtifactBacked, the predicate saveMetaItem uses to set intent override-artifact. READINGS: (A) A package-less overlay of the packaged container showcase_task (All Tasks (X), 6 columns). Before adoption, and after a restart without adoption, the list, the ?object= list and the by-name read all serve showcase_task.default as All Tasks (X)/6. Adoption into app.home reassigns the row (reassignedCount 1). In the same process, showcase_task.default is still All Tasks (X)/6 (the card's stale echo), and two new views are listed next to it. After a restart, all three doors serve showcase_task.default as the packaged All Tasks/7. The row now expands under its own name as showcase_task.showcase_task (All Tasks (X)/6, app.home) and as showcase_task.showcase_task.in_progress: bound to app.home, it is a container on another package's object (#21334's own-name arm). So the customisation no longer applies to the packaged view. Routing the rebind through the reconcile would make that happen at the click instead of at the next restart. (B) A package-less overlay of the expanded packaged view showcase_task.in_progress (In Progress (X); this is the View Config Save shape). Adoption reassigns it. After a restart, the list and the ?object= list serve two entries under that one name (the packaged In Progress and In Progress (X)), while the by-name read serves In Progress (X). The reconcile handles containers only, so routing it would not change B. (C, an option probe) The same two rows rebound to com.example.showcase, the package that ships the item they customise. After a restart, every door serves the customisation exactly as before adoption, and saveMetaItem with packageId com.example.showcase writes that same binding. (D, control) A true orphan: container rt_ticket, on an object no package owns. After adoption, the same process and a restart both serve the same names and the same content on every door. Only _packageId changes, from none to app.home. (E) A package-less overlay of a packaged object is refused at the save door (NOT_OVERRIDABLE 403, allowEnvironmentOverlay=false), so adoption has no object overlay to move. There is no non-view finding. THE CONTRACT: ADR-0070 D1 says: 'Overlays of artifact items (intent = override-artifact, allowOrgOverride) are unchanged — they keep their binding to the packaged item they customise.' A and B measure that adoption does not keep that binding. D5's affordance is worded for 'legacy package-less items' and 'legacy orphans', and D1 defines an orphan as a runtime-only create. The census bypass row stays, and the card stays open until the decision. Options and the four axes are in open_questions. files_changed: none. There is no commit; the branch was pushed empty at 6f4c518b01 as the write probe, and it holds nothing beyond main. line_budget: 0 changed lines. deviations: (1) My second probe run hung in the scratch: it mutated the row Map while iterating it. It held the verify lock for about 10 minutes before I stopped it with TaskStop, and the sibling #23182's build waited 5m24s behind it. The rerun was bounded with timeout and held the lock for 26 s. (2) I measured at 6f4c518b01, not at the dispatch's 06dbc4e59d; see above. (3) The empty remote branch is left for the follow-up dispatch. Deleting it is a write outside my budget. (4) The worktree is removed.",
  "tests": "gates: none run, because there is no diff. dispatch-gates was not derived: there is no change set, so --ran has nothing to reconcile. Build: pnpm --workspace-concurrency=2 --filter '@objectstack/objectql^...' build, under os-verify-lock: VERDICT command-exit 0, held 240 s. Measurement: one scratch vitest file in packages/objectql/src, over the real SchemaRegistry and the built @objectstack/metadata-protocol dist. It is not committed; a copy is in the PM scratchpad as issue-23198-b/zz-scratch-23198-adopt.test.ts.txt. Its cases log readings and assert nothing, so the readings are the evidence. Run 1: 4 cases, VERDICT command-exit 0, held 26 s. Run 2 (adds the option C probe): 'Tests 5 passed (5)', VERDICT command-exit 0, held 26 s, waited 142 s. Readings quoted from the run log: 'A restart before adoption, default': list, ?object= and item all ['All Tasks (X)',6,'com.example.showcase']. 'A adoption': success true, reassignedCount 1, view/showcase_task → app.home. 'A same process, object views': showcase_task.default=All Tasks (X)/6, showcase_task.in_progress=In Progress/2, showcase_task.showcase_task.in_progress=In Progress/2, showcase_task.showcase_task=All Tasks (X)/6. 'A restart after adoption, default': list, ?object= and item all ['All Tasks',7,'com.example.showcase']. 'A restart after adoption, own-name': ['All Tasks (X)',6,'app.home'] on every door. 'B restart after adoption': list [['In Progress',2],['In Progress (X)',2]] and item ['In Progress (X)',2]. 'C container restart': ['All Tasks (X)',6] on every door. 'C item restart': ['In Progress (X)',2] on every door. 'D restart': rt_ticket.default=All Tickets/app.home and rt_ticket.open=Open/app.home, the same as before adoption apart from the package. 'E save package-less object overlay': NOT_OVERRIDABLE 403. There is no ablation, because nothing was built.",
  "mcp_calls": "0. No MCP GitHub tool was called.",
  "api_writes": "1 relay dispatch, executed as objectstack-fleet[bot]: this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/23198/comments (scripts/pm/post-stamped.mjs). There were 0 pr_create and 0 label writes. The git push of the empty branch is not a REST write. Reads were gh api GETs of the card and its comments.",
  "open_questions": [
    {
      "question": "Should orphan adoption (POST /api/v1/packages/ID/adopt-orphans → reassignOrphanedMetadata) move a package-less overlay of an item a code package ships into the target base? Today it does. After a restart, that move alone drops the customisation from the packaged view (reading A), or serves two bodies under one view name (reading B). The stale registry this card names is the same-process echo of that move. ADR-0070 D1 says such overlays keep their binding to the packaged item they customise.",
      "options": [
        "A: route the rebind and keep the scope. After the raw update, reconcile each rebound view container row for its old and its new binding (the dispatch's suggested route), and move the census row. Business: no measured scenario wants this. An admin's View Config Save on a shipped list view is undone when Adopt loose items is clicked, at once instead of at the next restart, and B's two bodies under one name remain, because the reconcile handles containers only. Long term: the registry and the row agree, but the change ships a rebind that contradicts ADR-0070 D1's carve-out, and reversing D1 needs a new ADR. AI-proofing: an overlay that an AI or API caller wrote without a packageId changes meaning silently. Scope: the smallest diff (protocol.ts plus the census row), with no new surface.",
        "B: adoption keeps artifact overlays as they are. reassignOrphanedMetadata skips a row for which isArtifactBacked(type, name) holds. That is the one predicate saveMetaItem uses to set intent override-artifact, so there is no second derivation. It rebinds only runtime-only orphans and routes them through the reconcile, which removes the census bypass row. Measured: the kept rows keep serving the customisation (A and B before adoption), and control D shows a true orphan unchanged by the move. B1 skips silently: the response is unchanged, and the kept rows stay visible in Studio's package-less scope. B2 also names them in the response: ReassignOrphanedMetadataResponseSchema (packages/spec/src/api/package-lifecycle.zod.ts) gains a field, which is a spec change (Clause-② yes, widening) and touches domain:spec. Business: it matches what a runtime view save means. D5's end state of no orphans then reads as no runtime-only package-less rows, which is D1's own definition. Long term: it follows D1 as written, and no ADR is needed. AI-proofing: no row changes meaning silently, and B2 is louder than B1. Scope: small; B2 adds one declared response field.",
        "C: rebind an artifact overlay to the package that ships the item, and send true orphans to the target base, both routed through the reconcile. Measured (probe C): every door keeps serving the customisation after a restart, and this is the binding saveMetaItem writes when the save names the shipping package. Costs not measured: a name that two packages ship needs a rule, likely B for those, because a package-less overlay covers the name in every package and a bound one covers only one package. Uninstalling the code package would take the overlay with it, and the row would join a read-only package's commit history and export. Business: it empties the package-less scope, as D5 wants, but the admin asked to adopt into base X and these rows land in another package. Long term: it is the literal reading of D1's 'keep their binding to the packaged item they customise'. AI-proofing: no row changes meaning silently. Scope: the largest option: a per-row target choice, a rule for names several packages ship, and more pins. It widens what the adoption verb does."
      ],
      "recommendation": "B1, on the four axes. (1) Business: the measured writers of package-less overlays are runtime edits of shipped views, and no measured scenario wants adoption to undo them. (2) Long term: it is ADR-0070 D1 as written, it uses the one existing predicate, and it removes the census bypass row by routing the rebinds that remain. (3) AI-proofing: no row changes meaning silently. (4) Start-up scope: no new surface. B2's response field has no measured consumer: objectui's PackagesPage reads nothing of the adopt-orphans response beyond success or failure. A is the cheapest diff but ships the cause of the defect. C is the most complete end state, but it widens the verb and has three unmeasured costs. If the maintainer reads D5 as requiring the package-less scope to empty, C is the route, and the rule for names several packages ship needs a ruling first."
    }
  ],
  "out_of_scope_findings": [
    "carrier: this card's decision · noted, not filed: the save door accepts the base-bound row that reading B ends in (saveMetaItem, name showcase_task.in_progress, packageId app.home: success). After that, the list serves two bodies under one name, and both wear com.example.showcase's _packageId; the by-name read of the container in reading A also wears it after the rebind. Measured at the protocol layer only, and no producer other than adoption was measured, so this is not filed. Dedupe words: base-bound view named after a shipped view served twice; view row of another package wears the shipping package's envelope."
  ]
}

Generated by Claude Code

PM direction on the adoption half: B1, as execution under ADR-0070 (not a decision for the box) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T11:53Z

Answers the dev's needs_decision (report 6144921283). The claim 6144445721 and its branch stand.

What the dev measured (real SchemaRegistry over the built protocol, at 6f4c518b01):

adopt-orphans (reassignOrphanedMetadata) selects rows on package_id alone. So it moves a package-less overlay of a shipped item into the target base.
After a restart, the move alone drops the customisation from the packaged view (reading A), or serves two bodies under one view name (reading B).
The stale registry this card named is only the same-process echo of that move.
A true orphan (control D) moves cleanly.

Governing text:

ADR-0070 (Accepted), kernel section: "Overlays of artifact items (intent = override-artifact, allowOrgOverride) are unchanged — they keep their binding to the packaged item they customise."
ADR-0070 TL;DR 1: an orphan is a runtime-created item ("Every runtime-created metadata item is bound to a writable package").
ADR-0070 D5: the affordance "lists the legacy package-less items and offers "move into a base"" and "can bulk-assign legacy orphans to a default base".

⇒ The accepted record answers the dev's question in the direction of its option B1:

adoption keeps artifact overlays as they are, and skips a row for which isArtifactBacked(type, name) holds — the one predicate saveMetaItem already uses to set intent: override-artifact, ⛔ not a second derivation;
it rebinds runtime-only orphans only, and routes each rebound view container through reconcileViewExpansions, so the closing check's bypass row is removed.

Option A ships the cause; it contradicts the "unchanged" sentence. Option C widens what the verb does, against "unchanged", and carries three costs nobody has measured. This seat records B1 as execution; the maintainer can veto it on this card.

Execution bounds:

Clause-②: no. The request and response shapes are unchanged; B1 does not take B2's new response field.
The JSDoc at packages/spec/src/api/package-lifecycle.zod.ts ("bulk-rebind package-less (orphaned) metadata into this base (ADR-0070 D5)"):
- if B1 makes it false, it is corrected in the same PR, as a cross-lane, doc-only edit that this seat declares on domain:spec's seat post;
- that path is a contract face, so a contract-tier review is owed before the queue.
- If the dev reads it as still true (the adopted items are D1's orphans), it stays, and the PR body says why.
Pins:
- reading A's container overlay and reading B's view overlay keep their binding and keep serving their customisation, in the same process and after a restart;
- control D, a true orphan, is adopted and reconciled;
- the closing check's bypass row is gone.
The PR closes the card: Fixes #23198.

Generated by Claude Code

os-dev-report

{
  "issue": 23198,
  "status": "done",
  "branch": "claude/issue-23198-orphan-adoption-reconcile",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23264",
  "session": "session_01P88ehrZ6hM19hBzdpsQTTo (mode:subagent, the parent PM's id; the commits carry it as the Claude-Session trailer)",
  "premise_still_valid": true,
  "summary": "Built option B1, per PM comment 6144955760. The PR is #23264, draft, first line 'Fixes #23198', with 'Clause-②: no' at the start of a line and assignee os-support-ai. WHAT CHANGED: reassignOrphanedMetadata now skips a package-less row for which isArtifactBacked(type, name) holds. That is the predicate saveMetaItem uses to set intent override-artifact, with the type folded the way the save folds it; there is no second derivation. After each successful rebind of a row whose canonical type is view, the adoption prepares the row the way the list read does (storedOverlayEntries, at the new binding) and calls applyRegistryWriteThrough with reboundFrom set to the old package_id. reboundFrom passes through hydrateOverlayIntoRegistry and hydrateExpandedViewItems (a shared module-local HydrationOptions type) into reconcileViewExpansions. There, the binding form gains a rebind arm: the record row of the binding the row left is removed, and its names count as the row's old names. It is still one reconcile with its two callers, and the census's chain pins are unchanged. Rows of other types are still rebound in storage only (Zone 2, hypothesis 4). The closing check's bypass row and the bypass route kind are removed, and the adoption's write is recorded with route sameMember applyRegistryWriteThrough. The spec JSDoc in packages/spec/src/api/package-lifecycle.zod.ts is left as it is, because it stays true: the verb still bulk-rebinds orphaned package-less metadata, and in ADR-0070 an orphan is a runtime-created item while overlays of artifact items are 'unchanged'. The PR body says why, and no spec path is touched. The changeset is a patch for @objectstack/metadata-protocol, and each of its sentences was checked against the diff. One of them states the behaviour change: an environment whose only package-less rows are overlays now answers reassignedCount 0 and success false. Labels: zero writes. The dispatch named none, and skip-changeset does not apply. files_changed (against merge base 4f5679c26): .changeset/23198-orphan-adoption-keeps-overlays.md (+14/-0, new), packages/metadata-protocol/src/protocol.ts (+96/-6), packages/metadata-protocol/src/protocol.view-container-reset-expansions.test.ts (+137/-4: 4 new cases, and boot takes a row store for a restart), packages/metadata-protocol/src/protocol.view-expansion-reconcile-call-sites.test.ts (+8/-22), packages/metadata-protocol/src/protocol.object-registry-write-through-spelling.test.ts (+27/-3). line_budget: 317 changed lines (+282/-35) in 5 files, under the 3000 human-merge threshold. deviations: (1) The #8862 pin (protocol.object-registry-write-through-spelling.test.ts) is outside the claim's named region. Its pinned applyRegistryWriteThrough caller count went red at 5. It now reads 6, its header trace gains route 6, and one case shows the adoption writes a stored 'views' row through as 'view' and an orphaned 'objects' row not at all. (2) The first firing-control attempt (ablation leg 4) was refused by ablation-replace, because my replacement still contained the anchor, so nothing ran. The second attempt ran. (3) My first gate run raced my own parallel lane: check:type-check-debt was rebuilding packages while check:dts-closure scanned, which made dts-closure exit 1 on plugin-auth's d.ts. Rerun on the settled tree, it exited 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET) and exited 0 once the builds were in place. The --ran record carries the rerun codes, and both first readings are stated here and in the PR. (4) One build call used a wrong pnpm filter, held the lock 19 s and failed; the correct closure build followed. (5) Earlier this session, before this continuation, my needs_decision probe held the verify lock for about 10 minutes (reported in 6144921283). Every run this round was bounded with timeout. (6) The worktree is removed after the PR was opened.",
  "tests": "gates: dispatch-gates --commands --repo objectstack-ai/objectstack at head dc2e536938 (merge base 4f5679c26) derives 65 commands. --ran reports '65 derived, 65 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0). The two reruns are noted in summary deviations (3): dts-closure (73 packages, 173/173 declarations present) and dual-build-cjs-loads (108 entry points across 67 packages load). Long ones: check:type-check-debt exit 0 and check:query-options-erasure exit 0. Pins at head dc2e536938: the reset-expansions file, the census, the #8862 spelling file, the #22057 register-item call sites and the #9111 hydrator. 5 files, 55 tests passed, VERDICT command-exit 0. Full @objectstack/metadata-protocol suite before the merge (the merge touches plugin-sharing only): half 1 had 116 files passed and 3 skipped (25931 tests), VERDICT 0; half 2 had 117 of 118 files passed, the red being the #8862 caller-count pin that this PR updates. That file was rerun after the update: 12/12. pnpm --filter @objectstack/metadata-protocol typecheck: VERDICT command-exit 0. Ablations: the fix was committed first. Each leg used scripts/ablation-replace.mjs in WRAP mode (anchor hit, blob changed) and was restored with blob == HEAD d2367e10bc74 and an empty git diff HEAD. The suites import ./protocol.js, so they read src and need no build. Leg 1, the isArtifactBacked skip replaced by true: readings A, B and control D red (3 failed, 24 passed). Leg 2, the adoption's write-through never reached: control D and the record pin red (2 failed). Leg 3, the reconcile's rebind arm off: only the record pin red ('expected undefined to be Open'). Leg 4, the firing control, a fresh raw this.engine.update('sys_metadata', ...) in rollBackUnmanagedImport: the census case 'the writes in the source are exactly the recorded ones' red, naming 'rollBackUnmanagedImport: this.engine.update('sys_metadata''. Leg 5, the premise, protocol.ts restored to main's afbf960c26 under a trap (restored blob == HEAD, diff empty): 5 red, namely the census same-member route, A, B, D and the record pin. Leg 6, the view gate also admitting object: the #8862 route case red. Every leg went red in the predicted direction. Real registry: the scratch (uncommitted) rerun over the rebuilt dist, real SchemaRegistry, Tests 5 passed. Reading A: reassignedCount 0, and All Tasks (X)/6 on the list, ?object= and by-name doors, in the same process and after a restart. Reading B: reassigned [], and In Progress (X)/2 once, in the same process and after a restart. Control D: adopted, and served from app.home. Lint, a declared narrowing: the 4 changed .ts files are in eslint.config.mjs's population (print-config resolves a config for each); eslint --no-inline-config --format json reports 4 files, 0 errors, 0 warnings. Type-aware linting is off (no parserOptions.project or projectService), so the verdicts on untouched files cannot move. The full pnpm lint run is CI's.",
  "mcp_calls": "0. No MCP GitHub tool was called.",
  "api_writes": "This round: 2 relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches, fleet-write), executed as objectstack-fleet[bot]. (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft, #23264), plus POST /repos/objectstack-ai/objectstack/issues/23264/assignees; read back identical, 10736 bytes, assignee os-support-ai. (2) This os-dev-report comment: POST /repos/objectstack-ai/objectstack/issues/23198/comments. There were 0 label writes. git push is not counted. The earlier needs_decision round of this same claim spent 1 more comment (6144921283). Reads were gh api GETs.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed (PR Acceptance notes): the boot hydration (loadMetaFromDb) registers a package-bound container's own body without the _packageId that the list read's hydration stamps on it. So after a restart, the container's bare entry carries no package while its expanded views do. It was measured in the registry double only, and no wrong door answer was observed. The pin asserts the expanded views after a restart.",
    "carrier: PR #23264 Acceptance notes · noted, not filed (carried from 6144921283): the save door accepts a base-bound view named after a shipped view (showcase_task.in_progress, packageId app.home). The list then serves two bodies under that one name, and both wear the shipping package's _packageId. Adoption no longer produces that row. It was measured at the protocol layer only, with no other producer measured."
  ]
}

Generated by Claude Code

PM ACCEPT: PR #23264 at `dc2e536938` (the adoption half, B1) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T13:20Z

I checked against GitHub and the diff, not the report (report 6146315654).

PR form:
- draft, base main;
- the first line is Fixes #23198, and it is the body's only closing keyword, because this half closes the card;
- Clause-②: no sits at the start of a line;
- the assignee is os-support-ai.
Scope:
- 5 files, +282 / −35, all in packages/metadata-protocol/src/ plus a changeset;
- check-governed-merges --pr 23264: NOT governed;
- no packages/spec path.
B1 as directed (6144955760), read at the diff:
- reassignOrphanedMetadata skips a row for which isArtifactBacked(PLURAL_TO_SINGULAR[type] ?? type, name) holds, the save door's own fold, ⛔ no second derivation;
- each rebound view row goes through applyRegistryWriteThrough with reboundFrom, which threads into the one reconcileViewExpansions as a rebind arm;
- the closing check's bypass row and route kind are removed, and the adoption is recorded as a routed write.
The spec JSDoc stays, with a reason I accept: the verb still rebinds orphaned package-less metadata, and in ADR-0070 an orphan is a runtime-created item. No spec path is touched, so no contract face is touched.
Changeset (@objectstack/metadata-protocol patch). Each sentence checked against the diff:
- the title;
- bullet 1, the old behaviour;
- bullet 2: ADR-0070, the skip predicate, and "reassignedCount: 0 and success: false". That last clause is existing semantics: success was already reassigned.length > 0, per the comment at protocol.ts near reassignOrphanedMetadata. Only the population that reaches 0 is new;
- bullet 3, the write-through;
- bullet 4, the rebind arm;
- bullet 5, what is unchanged.
All hold.
Out of the claim's named region: the Third type === 'objects' tolerance in protocol.ts: applyObjectRegistryMutation CONSUMES the tolerant spelling rather than only guarding on it #8862 spelling pin (protocol.object-registry-write-through-spelling.test.ts), whose applyRegistryWriteThrough caller count moves from 5 to 6. Accepted as forced by the new call site.
Evidence (report):
- readings A and B now keep their overlays, in the same process and after a restart, and control D is adopted and served from the base at once (real SchemaRegistry);
- the 6 ablation legs each went red in the predicted direction, including the firing control (a fresh raw sys_metadata update reds the census) and the premise leg;
- 65 of 65 derived gates ran.
CI at this read: 27 success, 6 skipped, 6 running, none red. Landing waits for every check on this head.
Out of scope: the boot hydration's container _packageId stamp, and a base-bound view named after a shipped view. Both go in Acceptance notes, measured in doubles only, with no wrong door answer observed.

On merge, this card closes completed by Fixes #23198, and the registry-heal family closes with it.

Generated by Claude Code

Landed: PR #23264 → `9543e9c636` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T14:07Z

Merge: the merge queue merged it at 9543e9c636, after ACCEPT 6146507556. Fixes #23198 closed this card as completed.
Checked on origin/main by content:
- reassignOrphanedMetadata skips any row for which !this.isArtifactBacked(PLURAL_TO_SINGULAR[r.type] ?? r.type, …) fails, under the [#23198] comment;
- the rebound row's registry write-through is there;
- protocol.view-expansion-reconcile-call-sites.test.ts has 0 bypass hits.
Labels: pm:dispatched is removed in this stroke, so a closed card carries no state label. The domain, area and type labels stay.
Family: with the first half (PR fix(metadata-protocol): a republish of a view container retires the views it dropped, through one reconcile #23234) and this half both on main, every stored-row write in the registry-heal family (meta overlays: a deleted overlay stays in the /meta listing though dispatch correctly 404s (#4432 residual) #5079, A deleted runtime object is still served by SchemaRegistry.getObject — the registry heal reaches the metadata map but never objectContributors #6808, Registry heal restores the metadata-map view but never re-registers a packaged contributor definition an overlay save replaced #6853, metadata: resetting a published overlay on a packaged view answers reset:true, but the view LIST reads and the end-user list keep serving the overlay's expanded view items until restart #23149 and this card) reaches the one reconcile.
Acceptance notes, not filed: the boot hydration's container _packageId stamp, and a base-bound view named after a shipped view. Both were measured in doubles only, with no wrong door answer observed.

Generated by Claude Code

Navigation Menu

Repository navigation

metadata-protocol: a republish of a view container that drops a member keeps serving the dropped member's expanded view until restart #23198

What happens

Likely landing (to be confirmed by the fixing seat)

Family

Dedupe

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:studio` · `pm:blocked` (`finding` removed). This is the registry-heal family's closing card, by construction

PM ACCEPT: PR #23234 at `99dd8fda35` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T10:30Z

The dev's open question: where the orphan-adoption half goes. Answer B, not the dev's A

Out of scope

Landed: PR #23234 → `78c13bd152`

What is left on this card (the family's closing card)

PM direction on the adoption half: B1, as execution under ADR-0070 (not a decision for the box) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T11:53Z

PM ACCEPT: PR #23264 at `dc2e536938` (the adoption half, B1) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T13:20Z

Landed: PR #23264 → `9543e9c636` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T14:07Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: a republish of a view container that drops a member keeps serving the dropped member's expanded view until restart #23198

Description

What happens

Likely landing (to be confirmed by the fixing seat)

Family

Dedupe

Activity

objectstack-fleet commented on Oct 13, 2026

Triage: first grade, bug · priority:p2 · domain:engine · area:studio · pm:blocked (finding removed). This is the registry-heal family's closing card, by construction

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

PM ACCEPT: PR #23234 at 99dd8fda35 · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T10:30Z

The dev's open question: where the orphan-adoption half goes. Answer B, not the dev's A

Out of scope

objectstack-fleet commented on Oct 13, 2026

Landed: PR #23234 → 78c13bd152

What is left on this card (the family's closing card)

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

PM direction on the adoption half: B1, as execution under ADR-0070 (not a decision for the box) · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T11:53Z

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

PM ACCEPT: PR #23264 at dc2e536938 (the adoption half, B1) · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T13:20Z

objectstack-fleet commented on Oct 13, 2026

Landed: PR #23264 → 9543e9c636 · domain:engine seat 1 · session_01P88ehrZ6hM19hBzdpsQTTo · 2026-10-13T14:07Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade, `bug` · `priority:p2` · `domain:engine` · `area:studio` · `pm:blocked` (`finding` removed). This is the registry-heal family's closing card, by construction

PM ACCEPT: PR #23234 at `99dd8fda35` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T10:30Z

Landed: PR #23234 → `78c13bd152`

PM direction on the adoption half: B1, as execution under ADR-0070 (not a decision for the box) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T11:53Z

PM ACCEPT: PR #23264 at `dc2e536938` (the adoption half, B1) · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T13:20Z

Landed: PR #23264 → `9543e9c636` · `domain:engine` seat 1 · `session_01P88ehrZ6hM19hBzdpsQTTo` · 2026-10-13T14:07Z